Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:53

General

  • Target

    d5f0d487af46943e07a721bb4aa0ef14995632df6f96116ecd64915a0b98581f.exe

  • Size

    52KB

  • MD5

    d60ad808b8cf228430cc8190b693cada

  • SHA1

    a5738bf3e1cdf9ea416de83ac9a204c2b5026d34

  • SHA256

    d5f0d487af46943e07a721bb4aa0ef14995632df6f96116ecd64915a0b98581f

  • SHA512

    ae8c0830c115130efabe19f5c404d301fe390cf36edcc46afaba9535eea8321dbf26ed8e488f21e48cf2e769e9bd2d6aa3a33d405f457803731fa7213d6a2704

  • SSDEEP

    1536:HU6JhlQvW4R8ZDW2OsdCj7VhJ/YY5rInouy8rG:HRhlARSOsdwD/98outq

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 21 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 21 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 21 IoCs
  • UAC bypass 3 TTPs 21 IoCs
  • Disables RegEdit via registry modification 21 IoCs
  • Disables use of System Restore points 1 TTPs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 21 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 21 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 63 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
  • Modifies registry class 42 IoCs
  • Runs ping.exe 1 TTPs 63 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5f0d487af46943e07a721bb4aa0ef14995632df6f96116ecd64915a0b98581f.exe
    "C:\Users\Admin\AppData\Local\Temp\d5f0d487af46943e07a721bb4aa0ef14995632df6f96116ecd64915a0b98581f.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1208
    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4100
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:412
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1924
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3772
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3520
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3020
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1648
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2948
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:4572
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4624
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2672
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4076
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1204
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4256
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:5052
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4160
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1452
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:848
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4432
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:932
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                7⤵
                • Modifies WinLogon for persistence
                • Modifies visibility of file extensions in Explorer
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Disables RegEdit via registry modification
                • Event Triggered Execution: Image File Execution Options Injection
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:3032
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1584
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2216
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1380
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:4720
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2100
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:232
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                  8⤵
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  PID:2444
                • C:\Windows\SysWOW64\ping.exe
                  ping www.duniasex.com -n 65500 -l 1340
                  8⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4392
                • C:\Windows\SysWOW64\ping.exe
                  ping www.data0.net -n 65500 -l 1340
                  8⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2952
                • C:\Windows\SysWOW64\ping.exe
                  ping www.rasasayang.com.my -n 65500 -l 1210
                  8⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2936
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                  8⤵
                    PID:4332
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                    8⤵
                      PID:3992
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2084
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe taskkill /f /im tati.exe
                      8⤵
                        PID:3492
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe taskkill /f /im wscript.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:724
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe taskkill /f /im sys.exe
                        8⤵
                          PID:4180
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        7⤵
                          PID:2908
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.duniasex.com -n 65500 -l 1340
                          7⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1672
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.data0.net -n 65500 -l 1340
                          7⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:3108
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.rasasayang.com.my -n 65500 -l 1210
                          7⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:3076
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                          7⤵
                            PID:1604
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                            7⤵
                              PID:548
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                              7⤵
                                PID:656
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe taskkill /f /im tati.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:4052
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe taskkill /f /im wscript.exe
                                7⤵
                                  PID:5008
                                • C:\Windows\SysWOW64\rundll32.exe
                                  rundll32.exe taskkill /f /im sys.exe
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5112
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetWindowsHookEx
                                PID:5024
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                6⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SetWindowsHookEx
                                PID:4700
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.duniasex.com -n 65500 -l 1340
                                6⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:4024
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.data0.net -n 65500 -l 1340
                                6⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:4740
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.rasasayang.com.my -n 65500 -l 1210
                                6⤵
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:4992
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                6⤵
                                  PID:1044
                                • C:\Windows\SysWOW64\rundll32.exe
                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                  6⤵
                                    PID:736
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                    6⤵
                                      PID:1264
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      rundll32.exe taskkill /f /im tati.exe
                                      6⤵
                                        PID:540
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe taskkill /f /im wscript.exe
                                        6⤵
                                          PID:4584
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          rundll32.exe taskkill /f /im sys.exe
                                          6⤵
                                            PID:3004
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4116
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                          5⤵
                                          • Modifies WinLogon for persistence
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies visiblity of hidden/system files in Explorer
                                          • UAC bypass
                                          • Disables RegEdit via registry modification
                                          • Event Triggered Execution: Image File Execution Options Injection
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Checks whether UAC is enabled
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:3672
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5080
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2796
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1100
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                            6⤵
                                            • Modifies WinLogon for persistence
                                            • Modifies visibility of file extensions in Explorer
                                            • Modifies visiblity of hidden/system files in Explorer
                                            • UAC bypass
                                            • Disables RegEdit via registry modification
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Checks whether UAC is enabled
                                            • Drops file in System32 directory
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:2404
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2544
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2228
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3876
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4356
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                              7⤵
                                              • Modifies WinLogon for persistence
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies visiblity of hidden/system files in Explorer
                                              • UAC bypass
                                              • Disables RegEdit via registry modification
                                              • Event Triggered Execution: Image File Execution Options Injection
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Checks whether UAC is enabled
                                              • Drops file in System32 directory
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:688
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:628
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2148
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1380
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3620
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3540
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                8⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:232
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                8⤵
                                                • Suspicious use of FindShellTrayWindow
                                                PID:2460
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.duniasex.com -n 65500 -l 1340
                                                8⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:1476
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.data0.net -n 65500 -l 1340
                                                8⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:3912
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.rasasayang.com.my -n 65500 -l 1210
                                                8⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:2816
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  9⤵
                                                    PID:4180
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                  8⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3032
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                  8⤵
                                                    PID:548
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                    8⤵
                                                      PID:4052
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe taskkill /f /im tati.exe
                                                      8⤵
                                                        PID:1044
                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                        rundll32.exe taskkill /f /im wscript.exe
                                                        8⤵
                                                          PID:816
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe taskkill /f /im sys.exe
                                                          8⤵
                                                            PID:3188
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4688
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2604
                                                        • C:\Windows\SysWOW64\ping.exe
                                                          ping www.duniasex.com -n 65500 -l 1340
                                                          7⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:4116
                                                        • C:\Windows\SysWOW64\ping.exe
                                                          ping www.data0.net -n 65500 -l 1340
                                                          7⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:5052
                                                        • C:\Windows\SysWOW64\ping.exe
                                                          ping www.rasasayang.com.my -n 65500 -l 1210
                                                          7⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:1472
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            8⤵
                                                              PID:4584
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                            7⤵
                                                              PID:1780
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                              7⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4496
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                              7⤵
                                                                PID:4760
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                rundll32.exe taskkill /f /im tati.exe
                                                                7⤵
                                                                  PID:2228
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  rundll32.exe taskkill /f /im wscript.exe
                                                                  7⤵
                                                                    PID:3876
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe taskkill /f /im sys.exe
                                                                    7⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2872
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3596
                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:540
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                  6⤵
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:5040
                                                                • C:\Windows\SysWOW64\ping.exe
                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                  6⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:1972
                                                                • C:\Windows\SysWOW64\ping.exe
                                                                  ping www.data0.net -n 65500 -l 1340
                                                                  6⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:3952
                                                                • C:\Windows\SysWOW64\ping.exe
                                                                  ping www.rasasayang.com.my -n 65500 -l 1210
                                                                  6⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:2484
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    7⤵
                                                                      PID:1380
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                    6⤵
                                                                      PID:4720
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                      6⤵
                                                                        PID:4144
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                        6⤵
                                                                          PID:2164
                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                          rundll32.exe taskkill /f /im tati.exe
                                                                          6⤵
                                                                            PID:1980
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            rundll32.exe taskkill /f /im wscript.exe
                                                                            6⤵
                                                                              PID:2912
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              rundll32.exe taskkill /f /im sys.exe
                                                                              6⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4688
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                            5⤵
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:628
                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                            5⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:4976
                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                            ping www.data0.net -n 65500 -l 1340
                                                                            5⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:1464
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              6⤵
                                                                                PID:1044
                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                              5⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:3576
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                6⤵
                                                                                  PID:4496
                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                5⤵
                                                                                  PID:4464
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                  5⤵
                                                                                    PID:932
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                    5⤵
                                                                                      PID:2312
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe taskkill /f /im tati.exe
                                                                                      5⤵
                                                                                        PID:4720
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe taskkill /f /im wscript.exe
                                                                                        5⤵
                                                                                          PID:1980
                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                          rundll32.exe taskkill /f /im sys.exe
                                                                                          5⤵
                                                                                            PID:5108
                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                          4⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                          • UAC bypass
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Modifies system executable filetype association
                                                                                          • Adds Run key to start application
                                                                                          • Checks whether UAC is enabled
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • System policy modification
                                                                                          PID:5008
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1640
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1904
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3492
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4688
                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                            5⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                            • UAC bypass
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Modifies system executable filetype association
                                                                                            • Adds Run key to start application
                                                                                            • Checks whether UAC is enabled
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:3352
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2972
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1904
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                              6⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                              • UAC bypass
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Modifies system executable filetype association
                                                                                              • Adds Run key to start application
                                                                                              • Checks whether UAC is enabled
                                                                                              • Drops file in System32 directory
                                                                                              • Modifies Internet Explorer settings
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:5108
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4624
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2972
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:704
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:5168
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:5208
                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                7⤵
                                                                                                • Modifies WinLogon for persistence
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                • UAC bypass
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Modifies system executable filetype association
                                                                                                • Adds Run key to start application
                                                                                                • Checks whether UAC is enabled
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • System policy modification
                                                                                                PID:5244
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                  8⤵
                                                                                                    PID:5308
                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                    8⤵
                                                                                                      PID:5368
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                      8⤵
                                                                                                        PID:5456
                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                        8⤵
                                                                                                          PID:5516
                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                          8⤵
                                                                                                            PID:5600
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                            8⤵
                                                                                                              PID:5640
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                              8⤵
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:5744
                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                              8⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              • Runs ping.exe
                                                                                                              PID:6044
                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                              8⤵
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              • Runs ping.exe
                                                                                                              PID:6052
                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                              8⤵
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              • Runs ping.exe
                                                                                                              PID:6060
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                              8⤵
                                                                                                                PID:6068
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                8⤵
                                                                                                                  PID:5168
                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                  rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                  8⤵
                                                                                                                    PID:5432
                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                    8⤵
                                                                                                                      PID:744
                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                      rundll32.exe taskkill /f /im wscript.exe
                                                                                                                      8⤵
                                                                                                                        PID:5592
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                        8⤵
                                                                                                                          PID:5724
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                        7⤵
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:6076
                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                        7⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:5468
                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                        7⤵
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:5524
                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                        7⤵
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:5556
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                        7⤵
                                                                                                                          PID:5616
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                          7⤵
                                                                                                                            PID:5864
                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                            7⤵
                                                                                                                              PID:5756
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              rundll32.exe taskkill /f /im tati.exe
                                                                                                                              7⤵
                                                                                                                                PID:2972
                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                7⤵
                                                                                                                                  PID:5328
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe taskkill /f /im sys.exe
                                                                                                                                  7⤵
                                                                                                                                    PID:3244
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5476
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5540
                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5728
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  PID:5996
                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                  6⤵
                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:5452
                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                  6⤵
                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:5504
                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                  6⤵
                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:5684
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:5740
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:5260
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:6104
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe taskkill /f /im tati.exe
                                                                                                                                        6⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5152
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                        6⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6096
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                                        6⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5460
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                      5⤵
                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                      • UAC bypass
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies registry class
                                                                                                                                      • System policy modification
                                                                                                                                      PID:5600
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                        6⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                        • UAC bypass
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                        • Modifies registry class
                                                                                                                                        • System policy modification
                                                                                                                                        PID:5244
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                          7⤵
                                                                                                                                            PID:5424
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                            7⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5584
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                            7⤵
                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                            • UAC bypass
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies registry class
                                                                                                                                            • System policy modification
                                                                                                                                            PID:5756
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                              8⤵
                                                                                                                                                PID:3244
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                8⤵
                                                                                                                                                  PID:5736
                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                  8⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5952
                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                  8⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5580
                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:5328
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                    9⤵
                                                                                                                                                      PID:5400
                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                      9⤵
                                                                                                                                                        PID:1100
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                        9⤵
                                                                                                                                                          PID:5268
                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                          9⤵
                                                                                                                                                            PID:3564
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                            9⤵
                                                                                                                                                              PID:5584
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                              9⤵
                                                                                                                                                                PID:5424
                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                9⤵
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                PID:5400
                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                9⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:5460
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:2312
                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                  9⤵
                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:5424
                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                  9⤵
                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:5260
                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                  rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:5512
                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:6208
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:6256
                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                        rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:6292
                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                          rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:6308
                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                            rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:6336
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:5520
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                              8⤵
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              PID:6232
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                              8⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:6396
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                              8⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:6432
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                              8⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:6440
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:6484
                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                8⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:6616
                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:6680
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:6720
                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:6760
                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                      rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:6796
                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:6388
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:6460
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:6520
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                            PID:6648
                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                            PID:6928
                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                            PID:6944
                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                            PID:6952
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:6960
                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:7036
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:7144
                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                  rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                  rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:6228
                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                  rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:6280
                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:6936
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:7044
                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:7108
                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:6172
                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:6308
                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:6532
                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                            PID:6488
                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:6616
                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:6520
                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:6760
                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:6964
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                        PID:7032
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                          PID:7036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:6168
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                            PID:6380
                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:5736
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:5388
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:6524
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                    PID:6896
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:7004
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                      PID:6768
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:6408
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:6304
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:6532
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:6800
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:6940
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:6936
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                              PID:6388
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:6936
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:6680
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:6600
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:6568
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:7220
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:7296
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:7344
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:7404
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                          PID:7488
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6604
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                        PID:7228
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                        PID:7524
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                        PID:7540
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                        PID:7548
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:7556
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:7648
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:7748
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:7804
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:7828
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:7860
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:7532
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:7620
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:7696
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                      PID:7788
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                      PID:7928
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                      ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                      PID:7944
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                      ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                      PID:7952
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:7960
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:8024
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:8068
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:8164
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:7264
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:7408
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                            PID:7936
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                            PID:8128
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                            PID:8136
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:6980
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                              PID:8144
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:6504
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:8156
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:7236
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:7428
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:7492
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:7536
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:6980
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                            PID:5388
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:6720
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:6940
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                              PID:7004
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:6504
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:7236
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:7368
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:7420
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5696
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5756
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:704
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5300
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5588
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:5352
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:5848
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:1640
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:7960

                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              bca1e4108793da060723af194a525786

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              a45481832a9053e1d61c590f81506b803beab53a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              84b8ea1a3cfde13b328fa8a31a502e7539fb572fd879557538b5e85d2e9309dc

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              7f8785165b5b9cf70145f18016889b161440c84a24d61d84a97f22fa803b3f92b122604f91714c542182941b4b24fdbb0b104ee63a322f0a3582e78108e1fb1d

                                                                                                                                                                                                                                                                                                                                            • memory/232-209-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/232-283-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/412-71-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/540-295-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/628-263-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/688-297-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/704-344-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/848-162-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/932-172-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1100-239-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1204-127-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1204-134-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1208-416-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1208-108-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1208-0-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1380-271-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1452-155-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1584-182-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1648-96-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/1924-126-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2100-205-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2148-267-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2216-188-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2228-248-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2404-275-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2672-115-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2796-237-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2948-101-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/2972-327-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-319-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-145-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3032-215-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3352-356-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3352-439-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3492-312-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3520-85-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3540-279-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3596-290-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3672-303-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3672-259-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3772-81-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/3876-252-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4076-130-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4100-114-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4100-55-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4116-223-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4116-221-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4160-150-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4256-138-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4356-256-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4432-169-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4572-106-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4624-233-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4624-167-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4688-323-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4688-317-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4688-287-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/4720-198-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5008-301-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5008-337-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5024-217-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5052-193-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5052-227-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5108-365-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5168-348-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5208-352-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5244-467-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5244-428-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5244-386-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5268-474-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5328-491-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5352-362-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5352-370-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5404-374-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5424-485-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5448-383-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5456-382-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5476-420-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5508-396-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5520-489-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5540-424-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5580-458-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5580-460-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5600-463-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5600-398-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5624-405-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5640-408-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5696-410-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5736-452-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5756-414-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5756-477-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/5756-504-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6172-517-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6308-523-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6308-520-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6460-497-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6488-561-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6520-502-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6616-567-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6760-533-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/6964-545-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/7032-549-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/7036-553-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/7044-540-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                                            • memory/7044-509-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              168KB