Analysis

  • max time kernel
    20s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 04:43

General

  • Target

    ca1ee57569f9477da818853b62753f2c47248be909abebe24f1c90acbd2ca926.exe

  • Size

    53KB

  • MD5

    e9428bd8cd2546282122e6981a87deba

  • SHA1

    87397c23e798be937bdcba713c890b613d138734

  • SHA256

    ca1ee57569f9477da818853b62753f2c47248be909abebe24f1c90acbd2ca926

  • SHA512

    ff044fb6a64432051bb4b53a6c80e0fa60ab88cd7e537cf2ffc14fb29ef070ed7649fc5b6a11efcd538b8404f39e8ed68b0ded99f14e2f304f06ae087f57bf79

  • SSDEEP

    768:pMXkE7U60L5jTgc/iPQc0Ic+a+GlKyHu0y3u02qU6E4/IJe/nbcuyD7UIu:pMUYU6U5jUdPQc+n35KZg8/nouy8Iu

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 31 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 31 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 31 IoCs
  • UAC bypass 3 TTPs 31 IoCs
  • Disables RegEdit via registry modification 31 IoCs
  • Disables use of System Restore points 1 TTPs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 31 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 31 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 62 IoCs
  • Modifies registry class 62 IoCs
  • Runs ping.exe 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca1ee57569f9477da818853b62753f2c47248be909abebe24f1c90acbd2ca926.exe
    "C:\Users\Admin\AppData\Local\Temp\ca1ee57569f9477da818853b62753f2c47248be909abebe24f1c90acbd2ca926.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2728
    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3068
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:792
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3056
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2144
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2888
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1252
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2276
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2832
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2436
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1704
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2292
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2396
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1864
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:768
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1420
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1800
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2176
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:676
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2164
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                7⤵
                • Modifies WinLogon for persistence
                • Modifies visibility of file extensions in Explorer
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Disables RegEdit via registry modification
                • Event Triggered Execution: Image File Execution Options Injection
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3040
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1644
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1316
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2196
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1480
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1220
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1660
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                  8⤵
                  • Suspicious use of FindShellTrayWindow
                  PID:2056
                • C:\Windows\SysWOW64\ping.exe
                  ping www.duniasex.com -n 65500 -l 1340
                  8⤵
                    PID:1376
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    8⤵
                    • Runs ping.exe
                    PID:2440
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.rasasayang.com.my -n 65500 -l 1340
                    8⤵
                      PID:2460
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                    7⤵
                    • Suspicious use of FindShellTrayWindow
                    PID:2284
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.duniasex.com -n 65500 -l 1340
                    7⤵
                    • Runs ping.exe
                    PID:1684
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    7⤵
                      PID:3032
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.rasasayang.com.my -n 65500 -l 1340
                      7⤵
                        PID:1960
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                      6⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Modifies system executable filetype association
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:2676
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2692
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2696
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2528
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2652
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        7⤵
                        • Modifies WinLogon for persistence
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • UAC bypass
                        • Disables RegEdit via registry modification
                        • Event Triggered Execution: Image File Execution Options Injection
                        • Executes dropped EXE
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1536
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3064
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1588
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:596
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                          8⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:808
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          8⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1424
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2108
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                          8⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:2368
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.duniasex.com -n 65500 -l 1340
                          8⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1600
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.data0.net -n 65500 -l 1340
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:2060
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.rasasayang.com.my -n 65500 -l 1340
                          8⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:2144
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2304
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        7⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:2912
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.duniasex.com -n 65500 -l 1340
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:1788
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.data0.net -n 65500 -l 1340
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1736
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.rasasayang.com.my -n 65500 -l 1340
                        7⤵
                          PID:1912
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        6⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:1932
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.duniasex.com -n 65500 -l 1340
                        6⤵
                        • Runs ping.exe
                        PID:1556
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.data0.net -n 65500 -l 1340
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:2632
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.rasasayang.com.my -n 65500 -l 1340
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:1072
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                      5⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:2988
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1620
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:676
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1324
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        6⤵
                        • Modifies WinLogon for persistence
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • UAC bypass
                        • Disables RegEdit via registry modification
                        • Event Triggered Execution: Image File Execution Options Injection
                        • Executes dropped EXE
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1316
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1468
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1296
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2208
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2360
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2012
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                          7⤵
                          • Modifies WinLogon for persistence
                          • Modifies visibility of file extensions in Explorer
                          • Modifies visiblity of hidden/system files in Explorer
                          • UAC bypass
                          • Disables RegEdit via registry modification
                          • Event Triggered Execution: Image File Execution Options Injection
                          • Executes dropped EXE
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:2188
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2656
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                            8⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:2556
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2240
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2604
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2588
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1928
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                            8⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:264
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.duniasex.com -n 65500 -l 1340
                            8⤵
                              PID:484
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.data0.net -n 65500 -l 1340
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              PID:328
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.rasasayang.com.my -n 65500 -l 1340
                              8⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:792
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                            7⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:3008
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.duniasex.com -n 65500 -l 1340
                            7⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2892
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.data0.net -n 65500 -l 1340
                            7⤵
                              PID:2880
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.rasasayang.com.my -n 65500 -l 1340
                              7⤵
                                PID:1384
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2676
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                              6⤵
                              • Modifies WinLogon for persistence
                              • Modifies visibility of file extensions in Explorer
                              • Modifies visiblity of hidden/system files in Explorer
                              • UAC bypass
                              • Disables RegEdit via registry modification
                              • Event Triggered Execution: Image File Execution Options Injection
                              • Executes dropped EXE
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Checks whether UAC is enabled
                              • Drops file in System32 directory
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1088
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1164
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1256
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1664
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                7⤵
                                • Modifies WinLogon for persistence
                                • Modifies visibility of file extensions in Explorer
                                • Modifies visiblity of hidden/system files in Explorer
                                • UAC bypass
                                • Disables RegEdit via registry modification
                                • Event Triggered Execution: Image File Execution Options Injection
                                • Executes dropped EXE
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Checks whether UAC is enabled
                                • Drops file in System32 directory
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1460
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                  8⤵
                                  • Executes dropped EXE
                                  PID:1672
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                  8⤵
                                    PID:2012
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2664
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2556
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                    8⤵
                                      PID:2544
                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                      8⤵
                                        PID:2560
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                        8⤵
                                        • Suspicious use of FindShellTrayWindow
                                        PID:2652
                                      • C:\Windows\SysWOW64\ping.exe
                                        ping www.duniasex.com -n 65500 -l 1340
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        PID:2252
                                      • C:\Windows\SysWOW64\ping.exe
                                        ping www.data0.net -n 65500 -l 1340
                                        8⤵
                                          PID:536
                                        • C:\Windows\SysWOW64\ping.exe
                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                          8⤵
                                          • Runs ping.exe
                                          PID:1588
                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                        7⤵
                                          PID:2136
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          7⤵
                                            PID:2972
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                            7⤵
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1216
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.duniasex.com -n 65500 -l 1340
                                            7⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            PID:1220
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.data0.net -n 65500 -l 1340
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:920
                                          • C:\Windows\SysWOW64\ping.exe
                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                            7⤵
                                            • Runs ping.exe
                                            PID:2432
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          PID:972
                                        • C:\Windows\SysWOW64\ping.exe
                                          ping www.duniasex.com -n 65500 -l 1340
                                          6⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          PID:2696
                                        • C:\Windows\SysWOW64\ping.exe
                                          ping www.data0.net -n 65500 -l 1340
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          PID:2528
                                        • C:\Windows\SysWOW64\ping.exe
                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                          6⤵
                                            PID:2560
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                          5⤵
                                          • Modifies WinLogon for persistence
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies visiblity of hidden/system files in Explorer
                                          • UAC bypass
                                          • Disables RegEdit via registry modification
                                          • Event Triggered Execution: Image File Execution Options Injection
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Checks whether UAC is enabled
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • System policy modification
                                          PID:2548
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                            6⤵
                                              PID:108
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                              6⤵
                                                PID:2760
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                6⤵
                                                  PID:1088
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                  6⤵
                                                  • Modifies WinLogon for persistence
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • UAC bypass
                                                  • Disables RegEdit via registry modification
                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Checks whether UAC is enabled
                                                  • Drops file in System32 directory
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • System policy modification
                                                  PID:1296
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    7⤵
                                                      PID:1088
                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                      7⤵
                                                        PID:2672
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                        7⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2572
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                        7⤵
                                                          PID:1088
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                          7⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • UAC bypass
                                                          • Disables RegEdit via registry modification
                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Checks whether UAC is enabled
                                                          • Drops file in System32 directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • System policy modification
                                                          PID:2572
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            8⤵
                                                              PID:840
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                              8⤵
                                                                PID:2672
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                8⤵
                                                                  PID:968
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1256
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2672
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                  8⤵
                                                                    PID:108
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                    8⤵
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:1256
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                    8⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:3092
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.data0.net -n 65500 -l 1340
                                                                    8⤵
                                                                    • Runs ping.exe
                                                                    PID:3108
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                    8⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3120
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                  7⤵
                                                                    PID:3100
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                    7⤵
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:3196
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                    7⤵
                                                                    • Runs ping.exe
                                                                    PID:3292
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.data0.net -n 65500 -l 1340
                                                                    7⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:3300
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                    7⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:3316
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                  6⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                  • UAC bypass
                                                                  • Disables RegEdit via registry modification
                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                  • Modifies system executable filetype association
                                                                  • Adds Run key to start application
                                                                  • Checks whether UAC is enabled
                                                                  • Drops file in System32 directory
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • System policy modification
                                                                  PID:3308
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                    7⤵
                                                                      PID:3384
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3440
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                      7⤵
                                                                        PID:3488
                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                        7⤵
                                                                        • Modifies WinLogon for persistence
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                        • UAC bypass
                                                                        • Disables RegEdit via registry modification
                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                        • Modifies system executable filetype association
                                                                        • Checks whether UAC is enabled
                                                                        • Drops file in System32 directory
                                                                        • Modifies Internet Explorer settings
                                                                        • Modifies registry class
                                                                        • System policy modification
                                                                        PID:3528
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3552
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                          8⤵
                                                                            PID:3572
                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                            8⤵
                                                                              PID:3596
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                              8⤵
                                                                                PID:3632
                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                8⤵
                                                                                  PID:3656
                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                  8⤵
                                                                                    PID:3676
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                    8⤵
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:3704
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                    8⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3756
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                    8⤵
                                                                                    • Runs ping.exe
                                                                                    PID:3772
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                    8⤵
                                                                                    • Runs ping.exe
                                                                                    PID:3780
                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                  7⤵
                                                                                    PID:3764
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                    7⤵
                                                                                      PID:3856
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                      7⤵
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:3904
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                      7⤵
                                                                                        PID:3980
                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                        7⤵
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        • Runs ping.exe
                                                                                        PID:3992
                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                        7⤵
                                                                                        • Runs ping.exe
                                                                                        PID:4000
                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                      6⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3972
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                      6⤵
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:4040
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                      6⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3288
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                      6⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1296
                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                      6⤵
                                                                                      • Runs ping.exe
                                                                                      PID:3076
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                    5⤵
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:3340
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                    5⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    PID:3604
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    • Runs ping.exe
                                                                                    PID:3596
                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                    5⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    PID:3640
                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                  4⤵
                                                                                  • Drops file in System32 directory
                                                                                  PID:3620
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3676
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                    5⤵
                                                                                      PID:3840
                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                      5⤵
                                                                                      • Modifies WinLogon for persistence
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                      • UAC bypass
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                      • Modifies system executable filetype association
                                                                                      • Adds Run key to start application
                                                                                      • Checks whether UAC is enabled
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • System policy modification
                                                                                      PID:3936
                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                        6⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4032
                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                        6⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3388
                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                        6⤵
                                                                                          PID:3536
                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                          6⤵
                                                                                            PID:3680
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                            6⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                            • UAC bypass
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                            • Modifies system executable filetype association
                                                                                            • Checks whether UAC is enabled
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • System policy modification
                                                                                            PID:3676
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                              7⤵
                                                                                                PID:3968
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                7⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4048
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                7⤵
                                                                                                  PID:4032
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                  7⤵
                                                                                                    PID:3564
                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                    7⤵
                                                                                                      PID:3680
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                      7⤵
                                                                                                      • Modifies WinLogon for persistence
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                      • UAC bypass
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                      • Modifies system executable filetype association
                                                                                                      • Adds Run key to start application
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Modifies registry class
                                                                                                      • System policy modification
                                                                                                      PID:3532
                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                        8⤵
                                                                                                          PID:3840
                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                          8⤵
                                                                                                            PID:4092
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                            8⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2548
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                            8⤵
                                                                                                              PID:3748
                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                              8⤵
                                                                                                                PID:3416
                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                8⤵
                                                                                                                  PID:3488
                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                  8⤵
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:4052
                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                  8⤵
                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                  PID:3964
                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                  8⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2884
                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                  8⤵
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:4112
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                7⤵
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:3560
                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                7⤵
                                                                                                                  PID:4332
                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                  7⤵
                                                                                                                    PID:4356
                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                    7⤵
                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                    PID:4376
                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                  6⤵
                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                  • UAC bypass
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                  • Modifies system executable filetype association
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Modifies registry class
                                                                                                                  • System policy modification
                                                                                                                  PID:4340
                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                    7⤵
                                                                                                                      PID:4492
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                      7⤵
                                                                                                                        PID:4588
                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                        7⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4708
                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                        7⤵
                                                                                                                          PID:4812
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                          7⤵
                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                          • UAC bypass
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Modifies system executable filetype association
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • System policy modification
                                                                                                                          PID:4856
                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                            8⤵
                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                            • UAC bypass
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                            • Modifies system executable filetype association
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Checks whether UAC is enabled
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                            • Modifies registry class
                                                                                                                            • System policy modification
                                                                                                                            PID:4892
                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                              9⤵
                                                                                                                                PID:4928
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                9⤵
                                                                                                                                  PID:4984
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                  9⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5036
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                  9⤵
                                                                                                                                    PID:5084
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                    9⤵
                                                                                                                                      PID:4188
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                      9⤵
                                                                                                                                        PID:4240
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                        9⤵
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        PID:4320
                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                        9⤵
                                                                                                                                          PID:4448
                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                          9⤵
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:4464
                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                          9⤵
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:4472
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                        8⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3860
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                        8⤵
                                                                                                                                          PID:4596
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                          8⤵
                                                                                                                                            PID:4732
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                            8⤵
                                                                                                                                              PID:4772
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              8⤵
                                                                                                                                                PID:4800
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                8⤵
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:4812
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                8⤵
                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:4948
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                8⤵
                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                PID:4964
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                8⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:4932
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              7⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4940
                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                              7⤵
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              PID:5036
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                              7⤵
                                                                                                                                                PID:4244
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                7⤵
                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                PID:4256
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                7⤵
                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                PID:3232
                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                              6⤵
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              PID:4508
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                              6⤵
                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:4720
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                              6⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4772
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                              6⤵
                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:4780
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                            5⤵
                                                                                                                                              PID:4792
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                              5⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:4960
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                6⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                • UAC bypass
                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                • Modifies registry class
                                                                                                                                                • System policy modification
                                                                                                                                                PID:4940
                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                  7⤵
                                                                                                                                                    PID:2716
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                    7⤵
                                                                                                                                                      PID:4856
                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                      7⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:4560
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                        8⤵
                                                                                                                                                          PID:4872
                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                          8⤵
                                                                                                                                                            PID:4496
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                            8⤵
                                                                                                                                                              PID:4856
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                              8⤵
                                                                                                                                                                PID:4820
                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:2716
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:4984
                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:4900
                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:3936
                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:4900
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                          9⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4856
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:5064
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:4408
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                              9⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              PID:5064
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                              9⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:4408
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                              9⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:5004
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                              9⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              PID:5128
                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                            8⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                            PID:2716
                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:5256
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                              8⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              PID:5264
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:5272
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:5280
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:5356
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:5412
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:5476
                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:5516
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                        8⤵
                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:5548
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:5604
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5636
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:5680
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:5720
                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  PID:5844
                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:5928
                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      PID:6124
                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                        PID:5320
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      PID:5316
                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:5560
                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:5516
                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5680
                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:6096
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:5200
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:6028
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5804
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:6168
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:6252
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:6468
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:6492
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:6484
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6836
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:6908
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                    PID:7120
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:7128
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:7144
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:7136
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:6264
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                          PID:6424
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                          PID:6456
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                          PID:6580
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:6192
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:6240
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:6296
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:6352
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:6384
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:6416
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:6632
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                  PID:6652
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:6668
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:6640
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:6828
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:6900
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                              PID:6964
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:7004
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                  PID:7052
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:7104
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:6200
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:6180
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:6340
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:6352
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:6404
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                      PID:6504
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:6560
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:6640
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                            PID:6972
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                              PID:7108
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:6216
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                PID:6300
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:6408
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:6548
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:6488
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                            PID:6404
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:6980
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7020
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6948
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6904
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6596
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6216
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6380
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6488
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:6924
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:6868
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:6980
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6688
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6316
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:6860
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:6596
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6932
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7232
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7296
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7324
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7344
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7364
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7380
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7400
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7420
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7440
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7484
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              PID:7528
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              PID:7548
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7556
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7536
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7624
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7648
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7672
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7728
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7852
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7868
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8036
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8128
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6548
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7364
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7384
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7404
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7432
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7460
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7480
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7628
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7664
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7712
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7656
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7800
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8020
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7448
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7440
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7444
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7400
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7656
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8128
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7424
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8244
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "1216005302-658175720-131130654565700056481625382220288938181320655239-884498551"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "421992051490440643-1794323164-326163830-842654299-1626718916-1846925521242363997"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "1987283816451169369-1185760342-1203092750-149081827211612313161704905478-522178074"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "748853138232453350-11212181311926319523-26757907-1829407793897664030736713764"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "2072924966930573112-997312276-114159346-1101003567-1945645594-516370126-24122201"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-9438571-139514298713127094941418466364-736554391568433073122771574930031772"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "-1159478351-294084014145286506415342025727624522415276602941047928122-293428546"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "833804034-1835202251-556717819262236084416674389-14164120291585723086-2090194374"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-2921833191518153876-1397858974-13828232761226117590-5268052116766291511375708480"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "828939767902603920-15993072981791782570-1889135589-1837040685-961910568-1442860997"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "1921118048122941313517484045101647766466-2026865443-3326255752138490612-795621430"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "125834794-2086827008-1415580861169430768519865781975761713185048925623510597"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-730629094-19506369011361701616466336054-15163688711868231254-7647748421462671462"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-158254199510421335544869507591338814765-1073674445-1275401339274339641879935215"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5936

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      53KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      f55af2b3ba021a7e895992a7e3088f66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      847fa3752995497a7bc9552e0e2d9f96fbfc5821

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1429fdc8d623b678788de5fa5bda3af1473af0948812fa543083a07c8a90e700

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ef412695e89b9bde80d0d453ac0edbb4c20db7c195f185bbe187b258c4d037c065e98c070da67554f5603e02092f3cee110c19032fce4a934d2a2de914f8e09b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/596-287-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-115-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-144-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-104-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-116-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-151-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-123-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-87-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/676-217-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/676-320-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/768-211-0x0000000000310000-0x0000000000336000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/768-195-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/768-213-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/768-251-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/768-212-0x0000000000310000-0x0000000000336000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/792-78-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/792-82-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/808-294-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1220-245-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1252-134-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1296-336-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1296-340-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1316-344-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1316-232-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1316-345-0x00000000005C0000-0x00000000005E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1316-367-0x00000000005C0000-0x00000000005E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1324-330-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1420-200-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1424-298-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1480-241-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-304-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-279-0x00000000023D0000-0x00000000023F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-286-0x00000000023D0000-0x00000000023F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-289-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1536-292-0x00000000023D0000-0x00000000023F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1588-283-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1620-319-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1620-315-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1644-228-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1660-248-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1704-166-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1800-204-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1864-192-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2012-353-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2144-112-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2164-221-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2176-209-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2188-370-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2188-366-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2188-359-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2188-356-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2196-237-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2276-142-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2292-175-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2304-306-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2360-349-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2396-187-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-210-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-311-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-183-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-188-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-178-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-194-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-159-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2436-205-0x0000000000370000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-268-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2556-365-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2652-272-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2656-361-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2676-266-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2676-308-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2676-258-0x00000000004B0000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2676-261-0x00000000004B0000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2692-257-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2696-264-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-101-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-59-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-60-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-0-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-93-0x0000000000300000-0x0000000000326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2728-92-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2832-148-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-143-0x0000000000320000-0x0000000000346000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-309-0x0000000000320000-0x0000000000346000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-153-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-327-0x0000000000320000-0x0000000000346000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-124-0x0000000000320000-0x0000000000346000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2888-126-0x0000000000320000-0x0000000000346000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2988-314-0x0000000000340000-0x0000000000366000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2988-323-0x0000000000340000-0x0000000000366000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2988-332-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3040-249-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3040-235-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3040-224-0x00000000005E0000-0x0000000000606000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3056-100-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3064-278-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3068-77-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3068-73-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3068-103-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3068-106-0x0000000000290000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      152KB