Overview

overview

10

Static

static

3

02cb5c5e7e...07.exe

windows7-x64

10

02cb5c5e7e...07.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
  • Size 2.2MB
  • Sample240515-ws2cdach5z
  • SHA256 02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionpersistence

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 59 IoCs
  • Adds policy Run key to start application 2 TTPs 52 IoCs
    persistence
  • Disables RegEdit via registry modification 26 IoCs
    evasion
  • Modifies Windows Firewall 2 TTPs 26 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 63 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 26 IoCs
    persistence
  • AutoIT Executable 54 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
    "C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2320
              • C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 372
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3308
                  • C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                    "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:4688
                    • C:\Windows\SysWOW64\mscaps.exe
                      "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                      10⤵
                      • Executes dropped EXE
                      PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
          4⤵
            PID:2620
        • C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
          "C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe"
          3⤵
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\SysWOW64\KHATRA.exe
            C:\Windows\system32\KHATRA.exe
            4⤵
            • Adds policy Run key to start application
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies WinLogon
            • Drops autorun.inf file
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:976
            • C:\Windows\Xplorer.exe
              "C:\Windows\Xplorer.exe" /Windows
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of WriteProcessMemory
              PID:3224
              • C:\Windows\System\gHost.exe
                "C:\Windows\System\gHost.exe" /Reproduce
                6⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2200
                • C:\Windows\SysWOW64\KHATRA.exe
                  C:\Windows\system32\KHATRA.exe
                  7⤵
                  • Adds policy Run key to start application
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies WinLogon
                  • Drops autorun.inf file
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4648
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                    8⤵
                      PID:2080
                      • C:\Windows\SysWOW64\at.exe
                        AT /delete /yes
                        9⤵
                          PID:4468
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                        8⤵
                          PID:1616
                          • C:\Windows\SysWOW64\at.exe
                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                            9⤵
                              PID:1188
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                            8⤵
                              PID:4868
                              • C:\Windows\SysWOW64\regsvr32.exe
                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                9⤵
                                  PID:3876
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                8⤵
                                  PID:1180
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                    9⤵
                                    • Modifies Windows Firewall
                                    PID:4520
                            • C:\Windows\SysWOW64\KHATRA.exe
                              C:\Windows\system32\KHATRA.exe
                              6⤵
                              • Adds policy Run key to start application
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies WinLogon
                              • Drops autorun.inf file
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Modifies Internet Explorer settings
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2756
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                7⤵
                                  PID:3252
                                  • C:\Windows\SysWOW64\at.exe
                                    AT /delete /yes
                                    8⤵
                                      PID:2120
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                    7⤵
                                      PID:3080
                                      • C:\Windows\SysWOW64\at.exe
                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                        8⤵
                                          PID:3564
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                        7⤵
                                          PID:4916
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                            8⤵
                                              PID:4044
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                            7⤵
                                              PID:1072
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                8⤵
                                                • Modifies Windows Firewall
                                                PID:808
                                          • C:\Windows\SysWOW64\KHATRA.exe
                                            C:\Windows\system32\KHATRA.exe
                                            6⤵
                                            • Adds policy Run key to start application
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies WinLogon
                                            • Drops autorun.inf file
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Modifies Internet Explorer settings
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:2860
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                              7⤵
                                                PID:4384
                                                • C:\Windows\SysWOW64\at.exe
                                                  AT /delete /yes
                                                  8⤵
                                                    PID:4716
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                  7⤵
                                                    PID:1384
                                                    • C:\Windows\SysWOW64\at.exe
                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                      8⤵
                                                        PID:4540
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                      7⤵
                                                        PID:2056
                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                          8⤵
                                                            PID:4408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                          7⤵
                                                            PID:2712
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                              8⤵
                                                              • Modifies Windows Firewall
                                                              PID:964
                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                          C:\Windows\system32\KHATRA.exe
                                                          6⤵
                                                          • Adds policy Run key to start application
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Modifies WinLogon
                                                          • Drops autorun.inf file
                                                          • Drops file in System32 directory
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:1884
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                            7⤵
                                                              PID:2252
                                                              • C:\Windows\SysWOW64\at.exe
                                                                AT /delete /yes
                                                                8⤵
                                                                  PID:4948
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                7⤵
                                                                  PID:3440
                                                                  • C:\Windows\SysWOW64\at.exe
                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                    8⤵
                                                                      PID:2120
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                    7⤵
                                                                      PID:2508
                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                        8⤵
                                                                          PID:3080
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                        7⤵
                                                                          PID:396
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                            8⤵
                                                                            • Modifies Windows Firewall
                                                                            PID:3612
                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                        C:\Windows\system32\KHATRA.exe
                                                                        6⤵
                                                                        • Adds policy Run key to start application
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Modifies WinLogon
                                                                        • Drops autorun.inf file
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:3100
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                          7⤵
                                                                            PID:4424
                                                                            • C:\Windows\SysWOW64\at.exe
                                                                              AT /delete /yes
                                                                              8⤵
                                                                                PID:672
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                              7⤵
                                                                                PID:3496
                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                  8⤵
                                                                                    PID:324
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                  7⤵
                                                                                    PID:2016
                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                      8⤵
                                                                                        PID:4544
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                      7⤵
                                                                                        PID:4768
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                          8⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:2692
                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                      6⤵
                                                                                      • Adds policy Run key to start application
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Modifies WinLogon
                                                                                      • Drops autorun.inf file
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:2256
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                        7⤵
                                                                                          PID:2636
                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                            AT /delete /yes
                                                                                            8⤵
                                                                                              PID:2976
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                            7⤵
                                                                                              PID:3096
                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                8⤵
                                                                                                  PID:4008
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                7⤵
                                                                                                  PID:4688
                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                    8⤵
                                                                                                      PID:544
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                    7⤵
                                                                                                      PID:3852
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                        8⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        PID:2216
                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                    6⤵
                                                                                                    • Adds policy Run key to start application
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Modifies WinLogon
                                                                                                    • Drops autorun.inf file
                                                                                                    • Drops file in System32 directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:2304
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                      7⤵
                                                                                                        PID:1900
                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                          AT /delete /yes
                                                                                                          8⤵
                                                                                                            PID:4936
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                          7⤵
                                                                                                            PID:4556
                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                              8⤵
                                                                                                                PID:4032
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                              7⤵
                                                                                                                PID:3288
                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                  8⤵
                                                                                                                    PID:4144
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                  7⤵
                                                                                                                    PID:4952
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                      8⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      PID:1176
                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                  6⤵
                                                                                                                  • Adds policy Run key to start application
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Modifies WinLogon
                                                                                                                  • Drops autorun.inf file
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  PID:2692
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                    7⤵
                                                                                                                      PID:5004
                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                        AT /delete /yes
                                                                                                                        8⤵
                                                                                                                          PID:2192
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                        7⤵
                                                                                                                          PID:3576
                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                            8⤵
                                                                                                                              PID:4408
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                            7⤵
                                                                                                                              PID:2712
                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                8⤵
                                                                                                                                  PID:1944
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                7⤵
                                                                                                                                  PID:4824
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                    8⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:1652
                                                                                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                C:\Windows\system32\KHATRA.exe
                                                                                                                                6⤵
                                                                                                                                • Adds policy Run key to start application
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Modifies WinLogon
                                                                                                                                • Drops autorun.inf file
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                PID:544
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                  7⤵
                                                                                                                                    PID:3708
                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                      AT /delete /yes
                                                                                                                                      8⤵
                                                                                                                                        PID:4220
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                      7⤵
                                                                                                                                        PID:2288
                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                          8⤵
                                                                                                                                            PID:4356
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                          7⤵
                                                                                                                                            PID:1464
                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                              8⤵
                                                                                                                                                PID:4216
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                              7⤵
                                                                                                                                                PID:880
                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                  PID:2256
                                                                                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                              C:\Windows\system32\KHATRA.exe
                                                                                                                                              6⤵
                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Modifies WinLogon
                                                                                                                                              • Drops autorun.inf file
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                              PID:1372
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                7⤵
                                                                                                                                                  PID:3268
                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                    AT /delete /yes
                                                                                                                                                    8⤵
                                                                                                                                                      PID:4336
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                    7⤵
                                                                                                                                                      PID:3288
                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1264
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                        7⤵
                                                                                                                                                          PID:4068
                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                            8⤵
                                                                                                                                                              PID:4788
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                            7⤵
                                                                                                                                                              PID:3980
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                PID:2304
                                                                                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                                                                                            6⤵
                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                            • Drops autorun.inf file
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            PID:1276
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                              7⤵
                                                                                                                                                                PID:2672
                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:436
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:3320
                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:5040
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:4824
                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:4320
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:1080
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                              8⤵
                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                              PID:2280
                                                                                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                          • Drops autorun.inf file
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:616
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:3536
                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:1872
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:3084
                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:4640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:408
                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:4348
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:3268
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                            PID:4852
                                                                                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                        PID:4268
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:1580
                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                              AT /delete /yes
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:3148
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:808
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                      • Drops autorun.inf file
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:1104
                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                            AT /delete /yes
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:444
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:3980
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:3588
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Adds policy Run key to start application
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                • Drops autorun.inf file
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                      AT /delete /yes
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:1792
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:3412
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:872
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                              • Drops autorun.inf file
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                    AT /delete /yes
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:1216
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                            • Drops autorun.inf file
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                          • Drops autorun.inf file
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:384
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                              AT /delete /yes
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                PID:3764
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                        PID:3096
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                      • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                            AT /delete /yes
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                        PID:856
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4120
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                      PID:4452
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                              PID:3584
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:1944
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                    PID:3780

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1091

                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562.004

                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1091

                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 475KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c25155bf317cd421d795762bb5c3d7737c8fdc3e4acf0a3e178117df15d47997
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                5505.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\5505.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 406B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                @AE41DB.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 e7a1c9fa2a8166e78f2f3bd732720f6e0c7c36289686e904f6fa52877fb7364f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                aut9971.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aut9971.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 125KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b6b7ede5e5de9c5bf60f8775fcfb1f5bc0faf4aa99c2404fd2090dcfa75f6408
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4825.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4825.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.0MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07ffcde2097d0af67464907fec6a4079b92da11583013bae7d3313fa32312fe8
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4835.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4835.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 229KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4846.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4846.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 120KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4847.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4847.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 126KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4857.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4857.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 89KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4868.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4868.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 99KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp4869.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 172KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmp487A.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp487A.tmp
                                                                                                                                                                                                                                                                                                                                                                                • Size 276KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wtmps.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 276KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                launch.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 172KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                WdExt.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 bc29b857b5f59d737306ba09481af4bae54435c892f4e2e0d5b6e71d64883b9e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Admin0.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 129B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 125B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 98d1d1dcdc550e484a624ad0596ab1a23d4a6b9ba518e4d881d6b11aa3ef488f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 196B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 a062e0c95bf211a6e6a06489487d6f0f03646b88900e6de2cee92fdd1d0a82ab
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Admin2.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 102B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mydll.dll
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                                                                                                                                                                                                                                                                                                                                                                • Size 388KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Autoplay.inF
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Windows\INF\Autoplay.inF
                                                                                                                                                                                                                                                                                                                                                                                • Size 234B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mscaps.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Windows\SysWOW64\mscaps.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 200KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                memory/388-948-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/544-616-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/544-642-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/616-721-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/616-695-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/976-391-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1276-694-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1276-669-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1372-667-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1372-643-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1468-972-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1508-872-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1704-821-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1884-499-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2120-13-0x0000000010000000-0x0000000010015000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-759-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-974-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-682-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-936-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-579-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-809-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-349-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-532-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-709-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-630-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-1012-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-487-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-848-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-886-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2200-426-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2256-561-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2304-591-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2636-771-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2692-615-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2728-795-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2756-393-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2756-438-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2860-467-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3100-529-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-935-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-629-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-808-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-531-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-758-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-1011-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-835-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-347-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-486-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-973-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-885-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-578-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-708-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-425-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3224-668-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3320-1024-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4268-745-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4364-898-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4388-922-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4648-847-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4648-822-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4868-998-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4948-408-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4948-72-0x0000000000400000-0x000000000048D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download