Analysis

  • max time kernel
    97s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 03:35

General

  • Target

    ebdf7ecb3cb3e2b9dfc9fb4888212cc3d45cd18dfcf48f61d8fcc9235c715ffcN.exe

  • Size

    88KB

  • MD5

    34d29624c1651056798edac993da1fe0

  • SHA1

    fca66a2211be7fb7261d9bad43a1b48a6e753f1d

  • SHA256

    ebdf7ecb3cb3e2b9dfc9fb4888212cc3d45cd18dfcf48f61d8fcc9235c715ffc

  • SHA512

    5908c8666fd1c1aa7583a6ca03d4a57915bd7c3777b16be058cb03ec92072de267bf8f7b3af3360460d4adef91bcf7abe1d01ea72ef42acb564f19a3fed7d54c

  • SSDEEP

    768:GMXkE7U60L5jTgc/iPQc0Ic+a+GlKyHu0y3u02qU6E4/IJe/nbcuyD7UIu:GMUYU6U5jUdPQc+n35KZg8/nouy8Iu

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 62 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 62 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 62 IoCs
  • UAC bypass 3 TTPs 62 IoCs
  • Disables RegEdit via registry modification 62 IoCs
  • Disables use of System Restore points 1 TTPs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 62 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 62 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebdf7ecb3cb3e2b9dfc9fb4888212cc3d45cd18dfcf48f61d8fcc9235c715ffcN.exe
    "C:\Users\Admin\AppData\Local\Temp\ebdf7ecb3cb3e2b9dfc9fb4888212cc3d45cd18dfcf48f61d8fcc9235c715ffcN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2356
    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2012
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2788
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2940
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2588
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2604
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:840
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2092
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1484
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1536
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2040
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1588
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2860
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:816
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2396
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2896
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:596
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2864
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2856
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1072
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                7⤵
                • Modifies WinLogon for persistence
                • Modifies visibility of file extensions in Explorer
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1056
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:956
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:828
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1640
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:620
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2088
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1564
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:2968
                • C:\Windows\SysWOW64\ping.exe
                  ping www.duniasex.com -n 65500 -l 1340
                  8⤵
                    PID:760
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    8⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:2420
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.rasasayang.com.my -n 65500 -l 1340
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2204
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                  7⤵
                  • Suspicious use of FindShellTrayWindow
                  PID:2020
                • C:\Windows\SysWOW64\ping.exe
                  ping www.duniasex.com -n 65500 -l 1340
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:584
                • C:\Windows\SysWOW64\ping.exe
                  ping www.data0.net -n 65500 -l 1340
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:896
                • C:\Windows\SysWOW64\ping.exe
                  ping www.rasasayang.com.my -n 65500 -l 1340
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2488
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                6⤵
                • Modifies WinLogon for persistence
                • Modifies visibility of file extensions in Explorer
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1508
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2324
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2196
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2508
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2532
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  7⤵
                  • Modifies WinLogon for persistence
                  • Modifies visibility of file extensions in Explorer
                  • Modifies visiblity of hidden/system files in Explorer
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Event Triggered Execution: Image File Execution Options Injection
                  • Executes dropped EXE
                  • Modifies system executable filetype association
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2528
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2816
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2768
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2764
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2756
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2748
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2824
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                    8⤵
                    • Suspicious use of FindShellTrayWindow
                    PID:2760
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.duniasex.com -n 65500 -l 1340
                    8⤵
                      PID:2632
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.data0.net -n 65500 -l 1340
                      8⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:3028
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.rasasayang.com.my -n 65500 -l 1340
                      8⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:2732
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2132
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                    7⤵
                    • Suspicious use of FindShellTrayWindow
                    PID:684
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.duniasex.com -n 65500 -l 1340
                    7⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:696
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    7⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:1340
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.rasasayang.com.my -n 65500 -l 1340
                    7⤵
                      PID:1652
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                    6⤵
                    • Suspicious use of FindShellTrayWindow
                    PID:376
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.duniasex.com -n 65500 -l 1340
                    6⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:2432
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2160
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.rasasayang.com.my -n 65500 -l 1340
                    6⤵
                      PID:2896
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    5⤵
                    • Modifies WinLogon for persistence
                    • Modifies visibility of file extensions in Explorer
                    • Modifies visiblity of hidden/system files in Explorer
                    • UAC bypass
                    • Disables RegEdit via registry modification
                    • Event Triggered Execution: Image File Execution Options Injection
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Checks whether UAC is enabled
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2892
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:448
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1720
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2880
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                      6⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:2168
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1356
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1368
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3068
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1864
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2368
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        7⤵
                        • Modifies WinLogon for persistence
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • UAC bypass
                        • Disables RegEdit via registry modification
                        • Event Triggered Execution: Image File Execution Options Injection
                        • Executes dropped EXE
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:2512
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2644
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1708
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2652
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2792
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2704
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2428
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                          8⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:2788
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.duniasex.com -n 65500 -l 1340
                          8⤵
                            PID:2728
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.data0.net -n 65500 -l 1340
                            8⤵
                              PID:2828
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.rasasayang.com.my -n 65500 -l 1340
                              8⤵
                                PID:1916
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                              7⤵
                              • Suspicious use of FindShellTrayWindow
                              PID:2616
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.duniasex.com -n 65500 -l 1340
                              7⤵
                                PID:1688
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.data0.net -n 65500 -l 1340
                                7⤵
                                  PID:2156
                                • C:\Windows\SysWOW64\ping.exe
                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2916
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1764
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                6⤵
                                • Modifies WinLogon for persistence
                                • Modifies visibility of file extensions in Explorer
                                • Modifies visiblity of hidden/system files in Explorer
                                • UAC bypass
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Checks whether UAC is enabled
                                • Drops file in System32 directory
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1304
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2656
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:916
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1676
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                  7⤵
                                  • Modifies WinLogon for persistence
                                  • Modifies visibility of file extensions in Explorer
                                  • Modifies visiblity of hidden/system files in Explorer
                                  • UAC bypass
                                  • Disables RegEdit via registry modification
                                  • Event Triggered Execution: Image File Execution Options Injection
                                  • Executes dropped EXE
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Checks whether UAC is enabled
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:2280
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                    8⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:540
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                    8⤵
                                      PID:1096
                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                      8⤵
                                        PID:1712
                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                        8⤵
                                          PID:2128
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2532
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          8⤵
                                            PID:2224
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                            8⤵
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2820
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.duniasex.com -n 65500 -l 1340
                                            8⤵
                                            • System Location Discovery: System Language Discovery
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            PID:2428
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.data0.net -n 65500 -l 1340
                                            8⤵
                                            • Runs ping.exe
                                            PID:2256
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                            8⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            PID:2824
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                          7⤵
                                            PID:2908
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                            7⤵
                                              PID:848
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                              7⤵
                                              • Suspicious use of FindShellTrayWindow
                                              PID:620
                                            • C:\Windows\SysWOW64\ping.exe
                                              ping www.duniasex.com -n 65500 -l 1340
                                              7⤵
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              PID:3068
                                            • C:\Windows\SysWOW64\ping.exe
                                              ping www.data0.net -n 65500 -l 1340
                                              7⤵
                                                PID:2396
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                7⤵
                                                  PID:2068
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                6⤵
                                                • Suspicious use of FindShellTrayWindow
                                                PID:2368
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.duniasex.com -n 65500 -l 1340
                                                6⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:2224
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.data0.net -n 65500 -l 1340
                                                6⤵
                                                  PID:1816
                                                • C:\Windows\SysWOW64\ping.exe
                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                  6⤵
                                                    PID:2324
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                  5⤵
                                                  • Modifies WinLogon for persistence
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • UAC bypass
                                                  • Disables RegEdit via registry modification
                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Checks whether UAC is enabled
                                                  • Drops file in System32 directory
                                                  • Modifies Internet Explorer settings
                                                  PID:2708
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    6⤵
                                                      PID:2112
                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                      6⤵
                                                        PID:2892
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                        6⤵
                                                          PID:2748
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                          6⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • UAC bypass
                                                          • Disables RegEdit via registry modification
                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                          • Modifies system executable filetype association
                                                          • Checks whether UAC is enabled
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • System policy modification
                                                          PID:1064
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            7⤵
                                                              PID:3084
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                              7⤵
                                                                PID:3108
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                7⤵
                                                                  PID:3136
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                  7⤵
                                                                    PID:3160
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                    7⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                    • UAC bypass
                                                                    • Disables RegEdit via registry modification
                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                    • Modifies system executable filetype association
                                                                    • Adds Run key to start application
                                                                    • Checks whether UAC is enabled
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • System policy modification
                                                                    PID:3188
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                      8⤵
                                                                        PID:3208
                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                        8⤵
                                                                          PID:3224
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                          8⤵
                                                                            PID:3248
                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                            8⤵
                                                                              PID:3280
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                              8⤵
                                                                                PID:3300
                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                8⤵
                                                                                  PID:3324
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                  8⤵
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:3348
                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                  8⤵
                                                                                    PID:3396
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                    8⤵
                                                                                      PID:3404
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3412
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                    7⤵
                                                                                      PID:3420
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                      7⤵
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:3512
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                      7⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      PID:3588
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                      7⤵
                                                                                      • Runs ping.exe
                                                                                      PID:3604
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                      7⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      • Runs ping.exe
                                                                                      PID:3612
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                    6⤵
                                                                                    • Modifies WinLogon for persistence
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                    • UAC bypass
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                    • Modifies system executable filetype association
                                                                                    • Adds Run key to start application
                                                                                    • Checks whether UAC is enabled
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • System policy modification
                                                                                    PID:3596
                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                      7⤵
                                                                                        PID:3676
                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                        7⤵
                                                                                          PID:3732
                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                          7⤵
                                                                                            PID:3796
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                            7⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                            • UAC bypass
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Modifies system executable filetype association
                                                                                            • Adds Run key to start application
                                                                                            • Checks whether UAC is enabled
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • System policy modification
                                                                                            PID:3824
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                              8⤵
                                                                                                PID:3860
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                8⤵
                                                                                                  PID:3880
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                  8⤵
                                                                                                    PID:3904
                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                    8⤵
                                                                                                      PID:3928
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                      8⤵
                                                                                                        PID:3960
                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                        8⤵
                                                                                                          PID:3992
                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                          8⤵
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          PID:4012
                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                          8⤵
                                                                                                            PID:4064
                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                            8⤵
                                                                                                              PID:4072
                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                              8⤵
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              • Runs ping.exe
                                                                                                              PID:4080
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                            7⤵
                                                                                                              PID:4088
                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                              7⤵
                                                                                                                PID:3108
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                7⤵
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:3176
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                7⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3288
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                7⤵
                                                                                                                • Runs ping.exe
                                                                                                                PID:3280
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                7⤵
                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                PID:3300
                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                              6⤵
                                                                                                                PID:3292
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                6⤵
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:3460
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                6⤵
                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                PID:3720
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3680
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                6⤵
                                                                                                                  PID:3740
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                5⤵
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:3684
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                5⤵
                                                                                                                  PID:3908
                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                  5⤵
                                                                                                                    PID:3940
                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                    5⤵
                                                                                                                      PID:3948
                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                    4⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                    • UAC bypass
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    • Modifies system executable filetype association
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Checks whether UAC is enabled
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                    • Modifies registry class
                                                                                                                    • System policy modification
                                                                                                                    PID:764
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                      5⤵
                                                                                                                        PID:4008
                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                        5⤵
                                                                                                                          PID:3116
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                          5⤵
                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                          • UAC bypass
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                          • Modifies system executable filetype association
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies registry class
                                                                                                                          PID:3240
                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                            6⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3316
                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                            6⤵
                                                                                                                              PID:3332
                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                              6⤵
                                                                                                                                PID:3788
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                6⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2704
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                6⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                • UAC bypass
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                • Modifies system executable filetype association
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • System policy modification
                                                                                                                                PID:3968
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                  7⤵
                                                                                                                                    PID:4000
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                    7⤵
                                                                                                                                      PID:3996
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                      7⤵
                                                                                                                                        PID:3316
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                        7⤵
                                                                                                                                          PID:3596
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                          7⤵
                                                                                                                                            PID:3812
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                            7⤵
                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                            • UAC bypass
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:2708
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                              8⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3928
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                              8⤵
                                                                                                                                                PID:4028
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                8⤵
                                                                                                                                                  PID:3156
                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                  8⤵
                                                                                                                                                    PID:3440
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                    8⤵
                                                                                                                                                      PID:3788
                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                      8⤵
                                                                                                                                                        PID:3924
                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                        8⤵
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        PID:2624
                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                        8⤵
                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:3344
                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                        8⤵
                                                                                                                                                          PID:3488
                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                          8⤵
                                                                                                                                                            PID:3816
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                          7⤵
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          PID:3440
                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                          7⤵
                                                                                                                                                            PID:4104
                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                            7⤵
                                                                                                                                                              PID:4116
                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                              7⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              PID:4144
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                            • UAC bypass
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:4100
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                              7⤵
                                                                                                                                                                PID:4256
                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:4304
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:4328
                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                    7⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4376
                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                    • UAC bypass
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:4404
                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:4424
                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:4448
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:4480
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:4520
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4548
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:4580
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  PID:4616
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:4664
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4676
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:4692
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:4684
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  PID:4784
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:4864
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  PID:4876
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:4892
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  PID:4884
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:5020
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5040
                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5056
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:5028
                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                      PID:4184
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:4272
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:4396
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:4432
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:4452
                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:4716
                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:4956
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:5396
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                            PID:5924
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                            PID:5932
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                    PID:5148
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                          PID:5152
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                              PID:5452
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                  PID:5624
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                      PID:5264
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                      PID:764
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:4956
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:6184
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:6204
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:6212
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          PID:6196
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                          PID:6332
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                          PID:6348
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                          PID:6356
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:6340
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:6400
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:6460
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                          PID:6508
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                              PID:6544
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:6584
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                PID:6636
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:6684
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:6724
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                    PID:6756
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                        PID:6788
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                          PID:6828
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                            PID:6876
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                              PID:6908
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:6996
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                  PID:7028
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                    PID:7108
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:7116
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                    PID:7092
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                    PID:6376
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:6420
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                        PID:6436
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:6480
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                        PID:6544
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                              PID:6684
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                              PID:6728
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                  PID:6784
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                    PID:6792
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                        PID:6880
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                          PID:6900
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                            PID:6912
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                            PID:6940
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                              PID:7000
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                              PID:6996
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                              PID:7008
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:7156
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6500
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  PID:6548
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6752
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                    PID:6720
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:6820
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  PID:6800
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                  PID:6728
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                  PID:7008
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7080
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6432
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                    PID:6500
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6900
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6612
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                          PID:6340
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6732
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6612
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6444
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                                                                  PID:6684
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7172
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7196
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7220
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7240
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7260
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7280
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                PID:7304
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:7352
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7360
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7380
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7372
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7432
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                      PID:7488
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7576
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7584
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7592
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                          PID:7608
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7660
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:7696
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                              PID:7732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7752
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7772
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7796
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7840
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7864
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7904
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7960
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7976
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7984
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7968
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:8072
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                              PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7192
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7632
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7640
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7800
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7820
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7972
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7276
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7420
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7656
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7768
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7856
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8016
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7260
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7372
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8152
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7840
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7776
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7548
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8048
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8260
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8328
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8432
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8576
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8608
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8628
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8656
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8676
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8696
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "5605940641269039788-445443527371783988-6600660581223837587-1317849185-50233095"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "75634532514606534635748891641407020211511341031-105881179217592710701681993797"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-15912253-1509587398-930744138-12535138521443526572145726408720950708961818933087"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-1825892863-15550815621052381199578072821-610023670-1825989783529182070804254635"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "2087386544-1879308258-1486164861994652795970299340994749832-16425222821023957902"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "955784522-20223004291867173043171912267957886901-420939604-1618495841661699576"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "2122246977-1193117179568458483-367630809-1822021340-1493552178-1370226456-1741782128"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "1626072606-6891118361921693801-1298783698-1232555312585518155912963967-1106179271"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "18064085871320071988-1218420189122741900340285590810733521511091874611044644180"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "-396825016574686410-519461480-23220256-559233788-5315552022120898733423583194"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-1962114054-4643380341751303444223582670-21285241711908480922754218838425239565"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-1684469261-1413525995566492720-211455757-13375390271082771293-836694967229238677"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1778782170-1669382070-7723147854099311431402719681408326410-1296963645-1279245562"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "2116171328-409472986133124635215430721737424475157155013341607212670-1279022169"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-1391833884-1890449808-16730662431438942750-1816569638362452832-929978383-70538558"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "2035739742035735631586326504-327321090-1993594712-952793019-309396241444592415"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-4625307871179718363-1995894559-6107767521130365010-90596498-902393489-1091837797"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "15486866271308361070-17898346351599265374-1683648208-867608250-2026203217-1070308512"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-20221312418860249131684033379648454605140722134555382503513187642341306026678"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "241132827-1323322620-18081712001223600345-1936060428167637869-214816151-79079565"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "569902827932923705200742450-127768312-19253785443758549821558883279-2033954436"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-2034036671285862351226453745-180439613-1688337262-618483486510003863-2143602185"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "636845383804845984-20119101781645012384-401109085204199747151694833633291092"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "1518241953473270397-235997011-528219479-52916643426836172010852937741029466586"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "9020334718580142482014137287-198686551-52603816516711214851297458163-932420856"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11036

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      63a081776c5c980c3363c657eb617f98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3d338a6a820dc1edd44154e2a42669ca67f0cf19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      685d3e7d5da56ec559726096a62d969a6e68469fade2b7fc27d77effb4e904ec

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      884b26037d487dffd57907c0adc649a31d4cbd35b91f9f3cb2e9a84c16a291bf42ed97ab67f83ad81fd1d0bf0de87b7f3b84cfe3a1fb23518bd21b6e671d80ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/448-323-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/620-238-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/816-190-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/828-229-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/956-226-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1056-244-0x0000000000430000-0x0000000000456000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1056-232-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1056-225-0x0000000000430000-0x0000000000456000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1056-221-0x0000000000430000-0x0000000000456000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1056-249-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1072-218-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1356-346-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1368-348-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1484-144-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1484-140-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1508-256-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1508-258-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1508-267-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1508-268-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1508-250-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-207-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-165-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-149-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-266-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-156-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-195-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-196-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-191-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-317-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-192-0x0000000000280000-0x00000000002A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1564-247-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1588-172-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1640-234-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1720-327-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-115-0x00000000003D0000-0x00000000003F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-76-0x00000000003D0000-0x00000000003F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-62-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-75-0x00000000003D0000-0x00000000003F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-101-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2040-166-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2088-243-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2088-241-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2092-139-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2132-310-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2132-307-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2168-338-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2168-342-0x00000000003D0000-0x00000000003F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2196-263-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2324-259-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-91-0x00000000003B0000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-90-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-95-0x00000000003B0000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-59-0x00000000003B0000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-60-0x00000000003B0000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2356-0-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2396-208-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2396-199-0x00000000004B0000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2508-272-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-292-0x00000000003A0000-0x00000000003C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-304-0x00000000003A0000-0x00000000003C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-293-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-282-0x00000000003A0000-0x00000000003C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-277-0x00000000003A0000-0x00000000003C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2532-274-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2532-271-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2588-97-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2588-104-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2604-113-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-146-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-335-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-173-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-339-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-163-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-312-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-313-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-129-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-183-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-155-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2624-181-0x0000000000530000-0x0000000000556000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2748-299-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2756-297-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2764-289-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2788-83-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2816-281-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2824-303-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2856-214-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2860-185-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2864-210-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2864-206-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2880-333-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-341-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-334-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-326-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-329-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-319-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-340-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-347-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2892-318-0x0000000000540000-0x0000000000566000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2896-200-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2940-112-0x00000000004B0000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2940-122-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2940-94-0x00000000004B0000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB