Malware Analysis

Identify the the malicious process, what is its process ID (PID)? What process started this process?

Describe the process activity for the malware.

Did the malware modify any registry keys? If so, what is the significance of the keys it modified?

ystess e Process 13orkn 81Description company Name System 0.22 48K 584K 4 Interrupts Hardware Interrupts and DPCS 220 K 660 K 272 1,224 K 2,756 K 380 924 K 2,820 K 420 8,300 K 7,180 K 428 624 K 2,232 K 1644 824 K 3,492 K 3192 1,564 K 3,520 K 476 csrss. exe wininit. exe csrss. exe 0 6 8 Console window Host Console window Host Microsoft Corporation Microsoft Corporation winlogon. exe exp lorer. exe vmtoolsd. exe 0.07 12,988 K firefox. exe 0.17 136,788 K procexp.exe 4.66 16,024 K 1336 windows Explorer 1792 Mware Tools core Service 2336 Firefox Mozil1a corporation 2896 Sysinternals Process Explorer Procmon. exe 2,948 K 6,004 K 1936Process Monitor Sysinternals - www. sysinternals Procmon. exe 6.15 16,892 K mintty. exe bash, ??? 213D7E33-3912-1C20-3D38-1A0B15CDFFF33.exe 5,168 K 7,764 K 3156 5,140 K 6,336 K 3228 Terminal Andy Koppe Thomas wolff 0.26 2,348 K 5,488 K 3196 880K 3,784 K 2052 0.08 213D7E33-312-1C20-3D38-1A0B15CDFFF3). exe 0 9 2 3