Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 16:43

General

  • Target

    31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799.exe

  • Size

    275KB

  • MD5

    0ff2d18f373246c3a611c0996d0452d9

  • SHA1

    b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

  • SHA256

    31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

  • SHA512

    e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

  • SSDEEP

    6144:yniHo6nx2QY7slAFRWNBfrrWK0uTNRiuooqp6pfwWm+gIdJI7l:ySo6xg5kN530xuooqMVwsgN

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 44 IoCs
  • Disables RegEdit via registry modification 22 IoCs
  • Executes dropped EXE 23 IoCs
  • Modifies Windows Firewall 1 TTPs 22 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 22 IoCs
  • AutoIT Executable 46 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 22 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 43 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799.exe
    "C:\Users\Admin\AppData\Local\Temp\31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799.exe"
    1⤵
    • Adds policy Run key to start application
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\SysWOW64\KHATRA.exe
      C:\Windows\system32\KHATRA.exe
      2⤵
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\Xplorer.exe
        "C:\Windows\Xplorer.exe" /Windows
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\SysWOW64\KHATRA.exe
          C:\Windows\system32\KHATRA.exe
          4⤵
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /C AT /delete /yes
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3836
            • C:\Windows\SysWOW64\at.exe
              AT /delete /yes
              6⤵
                PID:5052
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
              5⤵
                PID:3552
                • C:\Windows\SysWOW64\at.exe
                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                  6⤵
                    PID:4920
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                  5⤵
                    PID:2620
                    • C:\Windows\SysWOW64\regsvr32.exe
                      RegSvr32 /S C:\Windows\system32\avphost.dll
                      6⤵
                        PID:5004
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                      5⤵
                        PID:4392
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                          6⤵
                          • Modifies Windows Firewall
                          PID:3824
                    • C:\Windows\SysWOW64\KHATRA.exe
                      C:\Windows\system32\KHATRA.exe
                      4⤵
                      • Adds policy Run key to start application
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies WinLogon
                      • Drops autorun.inf file
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Modifies Internet Explorer settings
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:4888
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                        5⤵
                          PID:2128
                          • C:\Windows\SysWOW64\at.exe
                            AT /delete /yes
                            6⤵
                              PID:2880
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                            5⤵
                              PID:3980
                              • C:\Windows\SysWOW64\at.exe
                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                6⤵
                                  PID:4484
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                5⤵
                                  PID:228
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                    6⤵
                                      PID:2916
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                    5⤵
                                      PID:936
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                        6⤵
                                        • Modifies Windows Firewall
                                        PID:3856
                                  • C:\Windows\SysWOW64\KHATRA.exe
                                    C:\Windows\system32\KHATRA.exe
                                    4⤵
                                    • Adds policy Run key to start application
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies WinLogon
                                    • Drops autorun.inf file
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:3396
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                      5⤵
                                        PID:4216
                                        • C:\Windows\SysWOW64\at.exe
                                          AT /delete /yes
                                          6⤵
                                            PID:1884
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                          5⤵
                                            PID:1216
                                            • C:\Windows\SysWOW64\at.exe
                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                              6⤵
                                                PID:5076
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                              5⤵
                                                PID:2772
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                  6⤵
                                                    PID:5032
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                  5⤵
                                                    PID:2452
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                      6⤵
                                                      • Modifies Windows Firewall
                                                      PID:4456
                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                  C:\Windows\system32\KHATRA.exe
                                                  4⤵
                                                  • Adds policy Run key to start application
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies WinLogon
                                                  • Drops autorun.inf file
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:2760
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                    5⤵
                                                      PID:3712
                                                      • C:\Windows\SysWOW64\at.exe
                                                        AT /delete /yes
                                                        6⤵
                                                          PID:3644
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                        5⤵
                                                          PID:1952
                                                          • C:\Windows\SysWOW64\at.exe
                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                            6⤵
                                                              PID:4436
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                            5⤵
                                                              PID:3564
                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                6⤵
                                                                  PID:428
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                5⤵
                                                                  PID:3424
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                    6⤵
                                                                    • Modifies Windows Firewall
                                                                    PID:1144
                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                C:\Windows\system32\KHATRA.exe
                                                                4⤵
                                                                • Adds policy Run key to start application
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Modifies WinLogon
                                                                • Drops autorun.inf file
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Modifies Internet Explorer settings
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:2524
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                  5⤵
                                                                    PID:1316
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      AT /delete /yes
                                                                      6⤵
                                                                        PID:4992
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                      5⤵
                                                                        PID:3676
                                                                        • C:\Windows\SysWOW64\at.exe
                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                          6⤵
                                                                            PID:2880
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                          5⤵
                                                                            PID:1356
                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                              6⤵
                                                                                PID:4444
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                              5⤵
                                                                                PID:1812
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                  6⤵
                                                                                  • Modifies Windows Firewall
                                                                                  PID:2708
                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                              C:\Windows\system32\KHATRA.exe
                                                                              4⤵
                                                                              • Adds policy Run key to start application
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Modifies WinLogon
                                                                              • Drops autorun.inf file
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Windows directory
                                                                              • Modifies Internet Explorer settings
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:1988
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                5⤵
                                                                                  PID:4720
                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                    AT /delete /yes
                                                                                    6⤵
                                                                                      PID:3856
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                    5⤵
                                                                                      PID:728
                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                        6⤵
                                                                                          PID:4516
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                        5⤵
                                                                                          PID:3996
                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                            6⤵
                                                                                              PID:4316
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                            5⤵
                                                                                              PID:4564
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                6⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:4528
                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                            4⤵
                                                                                            • Adds policy Run key to start application
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • Modifies WinLogon
                                                                                            • Drops autorun.inf file
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Windows directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            PID:3532
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                              5⤵
                                                                                                PID:2356
                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                  AT /delete /yes
                                                                                                  6⤵
                                                                                                    PID:1176
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                  5⤵
                                                                                                    PID:5032
                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                      6⤵
                                                                                                        PID:4188
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                      5⤵
                                                                                                        PID:4872
                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                          6⤵
                                                                                                            PID:4380
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                          5⤵
                                                                                                            PID:4360
                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                              6⤵
                                                                                                              • Modifies Windows Firewall
                                                                                                              PID:3396
                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                          4⤵
                                                                                                          • Adds policy Run key to start application
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Modifies WinLogon
                                                                                                          • Drops autorun.inf file
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          PID:4832
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                            5⤵
                                                                                                              PID:1760
                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                AT /delete /yes
                                                                                                                6⤵
                                                                                                                  PID:3756
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                5⤵
                                                                                                                  PID:4640
                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                    6⤵
                                                                                                                      PID:3624
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                    5⤵
                                                                                                                      PID:4076
                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                        6⤵
                                                                                                                          PID:4492
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                        5⤵
                                                                                                                          PID:4544
                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                            6⤵
                                                                                                                            • Modifies Windows Firewall
                                                                                                                            PID:4432
                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                        4⤵
                                                                                                                        • Adds policy Run key to start application
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Modifies WinLogon
                                                                                                                        • Drops autorun.inf file
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        PID:2088
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                          5⤵
                                                                                                                            PID:3044
                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                              AT /delete /yes
                                                                                                                              6⤵
                                                                                                                                PID:4828
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                              5⤵
                                                                                                                                PID:3032
                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:3740
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                  5⤵
                                                                                                                                    PID:4352
                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                      6⤵
                                                                                                                                        PID:204
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                      5⤵
                                                                                                                                        PID:1620
                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                          6⤵
                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                          PID:3828
                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                      4⤵
                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • Modifies WinLogon
                                                                                                                                      • Drops autorun.inf file
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                      PID:1528
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                        5⤵
                                                                                                                                          PID:1384
                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                            AT /delete /yes
                                                                                                                                            6⤵
                                                                                                                                              PID:2236
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                            5⤵
                                                                                                                                              PID:2256
                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                6⤵
                                                                                                                                                  PID:4420
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                5⤵
                                                                                                                                                  PID:2524
                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1264
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                    5⤵
                                                                                                                                                      PID:944
                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                        6⤵
                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                        PID:4000
                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                    4⤵
                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                    PID:4696
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                      5⤵
                                                                                                                                                        PID:2492
                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                          AT /delete /yes
                                                                                                                                                          6⤵
                                                                                                                                                            PID:3680
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                          5⤵
                                                                                                                                                            PID:3904
                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:3668
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                              5⤵
                                                                                                                                                                PID:4564
                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:4184
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3292
                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                      PID:1176
                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  PID:2352
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2432
                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:3308
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:4552
                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2508
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:2452
                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2560
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1088
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                    PID:5060
                                                                                                                                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Adds policy Run key to start application
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                • Drops autorun.inf file
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                PID:3852
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2872
                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                      AT /delete /yes
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1676
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3988
                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1980
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:4556
                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2284
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                              C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                              • Drops autorun.inf file
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                              PID:1616
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                    AT /delete /yes
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                            • Drops autorun.inf file
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:4212
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:3964
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:4420
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                          • Drops autorun.inf file
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          PID:1300
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:3724
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                              AT /delete /yes
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:4908
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:1524
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                      • Drops autorun.inf file
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                            AT /delete /yes
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                                                        PID:4368
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:2108
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:4072
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                  PID:1316
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:2732
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:3216
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:4960
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:1384
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:2412
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                • C:\Windows\System\gHost.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System\gHost.exe" /Reproduce
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                  PID:2708
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                    AT /delete /yes
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1108
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                      PID:1152
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                          PID:2452

                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0bf1e564321d43c170bbbfaa30a9a2a1

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      e5ed6a27f5efabdfed567630e31c55d055b015b4

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      9ee9e6b8d61448b0bdabaf2f0a707717d0dbf8570298436fa0b4b2636ca74455

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      ca48fdd25cd51b76bfc93b68cc0fddc0b403a5b816f309ced5f62fd37cf488e06ef881e8a534e3e5cc337dbda6c0718e0edaedc4555f0020f86a3bf2b2f11380

                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0bf1e564321d43c170bbbfaa30a9a2a1

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      e5ed6a27f5efabdfed567630e31c55d055b015b4

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      9ee9e6b8d61448b0bdabaf2f0a707717d0dbf8570298436fa0b4b2636ca74455

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      ca48fdd25cd51b76bfc93b68cc0fddc0b403a5b816f309ced5f62fd37cf488e06ef881e8a534e3e5cc337dbda6c0718e0edaedc4555f0020f86a3bf2b2f11380

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\KHATARNAKH.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\System\gHost.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\System\gHost.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\Xplorer.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\Xplorer.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\Windows\inf\Autoplay.inF

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      234B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                    • C:\\KHATRA.exe

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      275KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0ff2d18f373246c3a611c0996d0452d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b0e39cb91ddcd2b87d56122cb243b7e2faae1a18

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      31ff1e523eb2d73423c1487d86cb832c3001576a9ee8510752dc01da0dd8a799

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e6ac7fe29e0bdf41528bbd140e2ce442cd4fa30738c685335f21e81a4da8ca588ec87e4877462d88179ec23afdd07acdd463683ba86a86186214e319c3f1e95b

                                                                                                                                                                                                                                                                                                    • memory/224-281-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/224-282-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1300-280-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1300-279-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1316-287-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1528-265-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1528-266-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1536-186-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1536-174-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1580-170-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1580-132-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1616-276-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1616-275-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1988-248-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/1988-252-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2012-283-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2012-284-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2088-264-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2088-263-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2352-271-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2352-272-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2524-234-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2524-246-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2760-223-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2760-231-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2844-148-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/2844-269-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3392-268-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3392-147-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3396-205-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3396-216-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3532-259-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3532-255-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3748-285-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3748-286-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3852-274-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3852-273-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3852-171-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/3852-138-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4592-278-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4592-277-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4696-270-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4696-267-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4832-261-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4832-262-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4888-190-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                                                                    • memory/4888-201-0x0000000000400000-0x000000000049C000-memory.dmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      624KB