Overview

overview

10

Static

static

3

02cb5c5e7e...07.exe

windows7-x64

10

02cb5c5e7e...07.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 18:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe

  • Size

    2.2MB

  • MD5

    21f3048771aabc6dc4be59001e31b98f

  • SHA1

    a20b94a3f31817bb322c586e3cb318e51524def0

  • SHA256

    02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607

  • SHA512

    065804a5e4fe5e44ff4b0af57c530c0fedc0f5d9ff8219a7bb9ad1d4e5afce64e437a796e09691eda393e94318813a5a4d4b2864567179814cee0f2e047b75ba

  • SSDEEP

    49152:Luu30KZbTChxKCnFnQXBbrtgb/iQvu0UHOY8:LH0KZ6hxvWbrtUTrUHOY8

Score
9/10
evasionpersistence

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 59 IoCs
  • Adds policy Run key to start application 2 TTPs 52 IoCs
    persistence
  • Disables RegEdit via registry modification 26 IoCs
    evasion
  • Modifies Windows Firewall 2 TTPs 26 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 63 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 26 IoCs
    persistence
  • AutoIT Executable 54 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
    "C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2320
              • C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 372
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3308
                  • C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                    "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:4688
                    • C:\Windows\SysWOW64\mscaps.exe
                      "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                      10⤵
                      • Executes dropped EXE
                      PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
          4⤵
            PID:2620
        • C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
          "C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe"
          3⤵
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\SysWOW64\KHATRA.exe
            C:\Windows\system32\KHATRA.exe
            4⤵
            • Adds policy Run key to start application
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies WinLogon
            • Drops autorun.inf file
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:976
            • C:\Windows\Xplorer.exe
              "C:\Windows\Xplorer.exe" /Windows
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of WriteProcessMemory
              PID:3224
              • C:\Windows\System\gHost.exe
                "C:\Windows\System\gHost.exe" /Reproduce
                6⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2200
                • C:\Windows\SysWOW64\KHATRA.exe
                  C:\Windows\system32\KHATRA.exe
                  7⤵
                  • Adds policy Run key to start application
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies WinLogon
                  • Drops autorun.inf file
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4648
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                    8⤵
                      PID:2080
                      • C:\Windows\SysWOW64\at.exe
                        AT /delete /yes
                        9⤵
                          PID:4468
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                        8⤵
                          PID:1616
                          • C:\Windows\SysWOW64\at.exe
                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                            9⤵
                              PID:1188
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                            8⤵
                              PID:4868
                              • C:\Windows\SysWOW64\regsvr32.exe
                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                9⤵
                                  PID:3876
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                8⤵
                                  PID:1180
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                    9⤵
                                    • Modifies Windows Firewall
                                    PID:4520
                            • C:\Windows\SysWOW64\KHATRA.exe
                              C:\Windows\system32\KHATRA.exe
                              6⤵
                              • Adds policy Run key to start application
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies WinLogon
                              • Drops autorun.inf file
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Modifies Internet Explorer settings
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2756
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                7⤵
                                  PID:3252
                                  • C:\Windows\SysWOW64\at.exe
                                    AT /delete /yes
                                    8⤵
                                      PID:2120
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                    7⤵
                                      PID:3080
                                      • C:\Windows\SysWOW64\at.exe
                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                        8⤵
                                          PID:3564
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                        7⤵
                                          PID:4916
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                            8⤵
                                              PID:4044
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                            7⤵
                                              PID:1072
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                8⤵
                                                • Modifies Windows Firewall
                                                PID:808
                                          • C:\Windows\SysWOW64\KHATRA.exe
                                            C:\Windows\system32\KHATRA.exe
                                            6⤵
                                            • Adds policy Run key to start application
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies WinLogon
                                            • Drops autorun.inf file
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Modifies Internet Explorer settings
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:2860
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                              7⤵
                                                PID:4384
                                                • C:\Windows\SysWOW64\at.exe
                                                  AT /delete /yes
                                                  8⤵
                                                    PID:4716
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                  7⤵
                                                    PID:1384
                                                    • C:\Windows\SysWOW64\at.exe
                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                      8⤵
                                                        PID:4540
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                      7⤵
                                                        PID:2056
                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                          8⤵
                                                            PID:4408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                          7⤵
                                                            PID:2712
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                              8⤵
                                                              • Modifies Windows Firewall
                                                              PID:964
                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                          C:\Windows\system32\KHATRA.exe
                                                          6⤵
                                                          • Adds policy Run key to start application
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Modifies WinLogon
                                                          • Drops autorun.inf file
                                                          • Drops file in System32 directory
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:1884
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                            7⤵
                                                              PID:2252
                                                              • C:\Windows\SysWOW64\at.exe
                                                                AT /delete /yes
                                                                8⤵
                                                                  PID:4948
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                7⤵
                                                                  PID:3440
                                                                  • C:\Windows\SysWOW64\at.exe
                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                    8⤵
                                                                      PID:2120
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                    7⤵
                                                                      PID:2508
                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                        8⤵
                                                                          PID:3080
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                        7⤵
                                                                          PID:396
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                            8⤵
                                                                            • Modifies Windows Firewall
                                                                            PID:3612
                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                        C:\Windows\system32\KHATRA.exe
                                                                        6⤵
                                                                        • Adds policy Run key to start application
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Modifies WinLogon
                                                                        • Drops autorun.inf file
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:3100
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                          7⤵
                                                                            PID:4424
                                                                            • C:\Windows\SysWOW64\at.exe
                                                                              AT /delete /yes
                                                                              8⤵
                                                                                PID:672
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                              7⤵
                                                                                PID:3496
                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                  8⤵
                                                                                    PID:324
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                  7⤵
                                                                                    PID:2016
                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                      8⤵
                                                                                        PID:4544
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                      7⤵
                                                                                        PID:4768
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                          8⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:2692
                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                      6⤵
                                                                                      • Adds policy Run key to start application
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Modifies WinLogon
                                                                                      • Drops autorun.inf file
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:2256
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                        7⤵
                                                                                          PID:2636
                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                            AT /delete /yes
                                                                                            8⤵
                                                                                              PID:2976
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                            7⤵
                                                                                              PID:3096
                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                8⤵
                                                                                                  PID:4008
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                7⤵
                                                                                                  PID:4688
                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                    8⤵
                                                                                                      PID:544
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                    7⤵
                                                                                                      PID:3852
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                        8⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        PID:2216
                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                    6⤵
                                                                                                    • Adds policy Run key to start application
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Modifies WinLogon
                                                                                                    • Drops autorun.inf file
                                                                                                    • Drops file in System32 directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:2304
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                      7⤵
                                                                                                        PID:1900
                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                          AT /delete /yes
                                                                                                          8⤵
                                                                                                            PID:4936
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                          7⤵
                                                                                                            PID:4556
                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                              8⤵
                                                                                                                PID:4032
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                              7⤵
                                                                                                                PID:3288
                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                  8⤵
                                                                                                                    PID:4144
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                  7⤵
                                                                                                                    PID:4952
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                      8⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      PID:1176
                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                  6⤵
                                                                                                                  • Adds policy Run key to start application
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Modifies WinLogon
                                                                                                                  • Drops autorun.inf file
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  PID:2692
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                    7⤵
                                                                                                                      PID:5004
                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                        AT /delete /yes
                                                                                                                        8⤵
                                                                                                                          PID:2192
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                        7⤵
                                                                                                                          PID:3576
                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                            8⤵
                                                                                                                              PID:4408
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                            7⤵
                                                                                                                              PID:2712
                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                8⤵
                                                                                                                                  PID:1944
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                7⤵
                                                                                                                                  PID:4824
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                    8⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:1652
                                                                                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                C:\Windows\system32\KHATRA.exe
                                                                                                                                6⤵
                                                                                                                                • Adds policy Run key to start application
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Modifies WinLogon
                                                                                                                                • Drops autorun.inf file
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                PID:544
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                  7⤵
                                                                                                                                    PID:3708
                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                      AT /delete /yes
                                                                                                                                      8⤵
                                                                                                                                        PID:4220
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                      7⤵
                                                                                                                                        PID:2288
                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                          8⤵
                                                                                                                                            PID:4356
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                          7⤵
                                                                                                                                            PID:1464
                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                              8⤵
                                                                                                                                                PID:4216
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                              7⤵
                                                                                                                                                PID:880
                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                  PID:2256
                                                                                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                              C:\Windows\system32\KHATRA.exe
                                                                                                                                              6⤵
                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Modifies WinLogon
                                                                                                                                              • Drops autorun.inf file
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                              PID:1372
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                7⤵
                                                                                                                                                  PID:3268
                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                    AT /delete /yes
                                                                                                                                                    8⤵
                                                                                                                                                      PID:4336
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                    7⤵
                                                                                                                                                      PID:3288
                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1264
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                        7⤵
                                                                                                                                                          PID:4068
                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                            8⤵
                                                                                                                                                              PID:4788
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                            7⤵
                                                                                                                                                              PID:3980
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                PID:2304
                                                                                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                                                                                            6⤵
                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                            • Drops autorun.inf file
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            PID:1276
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                              7⤵
                                                                                                                                                                PID:2672
                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:436
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:3320
                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:5040
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:4824
                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:4320
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:1080
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                              8⤵
                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                              PID:2280
                                                                                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                          • Drops autorun.inf file
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:616
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:3536
                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:1872
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:3084
                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:4640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:408
                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:4348
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:3268
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                            PID:4852
                                                                                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                        PID:4268
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:1580
                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                              AT /delete /yes
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:3148
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:808
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                      • Drops autorun.inf file
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:1104
                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                            AT /delete /yes
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:444
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:3980
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:3588
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Adds policy Run key to start application
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                • Drops autorun.inf file
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                      AT /delete /yes
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:1792
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:3412
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                              RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:872
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                  netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                              • Drops autorun.inf file
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                    AT /delete /yes
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                            RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:1216
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                            • Drops autorun.inf file
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                  AT /delete /yes
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                          RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                              netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                          • Drops autorun.inf file
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:384
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                              AT /delete /yes
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                PID:3764
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                      RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                        PID:3096
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                          netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                      • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                            AT /delete /yes
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                    RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                        netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                    • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                        PID:856
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                              AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                  RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4120
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                      netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                      PID:4452
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                  • Drops autorun.inf file
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                        AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                              PID:3584
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                        RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                            netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:1944
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                          AT /delete /yes
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                                                                                                                                                                                                                            AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                                                                                RegSvr32 /S C:\Windows\system32\avphost.dll
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                    netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                    PID:3780

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                          Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1091

                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                          Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                          T1091

                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\02cb5c5e7e3c2ab21849927122d00aff871db962752410a303728394fd39f607.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            475KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            f76e712e7d4a7105beae26912839a54e

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            4fdb2bdf9e0c71efc34a297b3f1eb9bdee227a69

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            c25155bf317cd421d795762bb5c3d7737c8fdc3e4acf0a3e178117df15d47997

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            7a428894a6162d47c9703ebb922436155c1795a547a69d2a23c4d5749393b2e28a3f1afcc96c21bb00ad20d6e570692a1a4525d9741e8e294d2c20a3cc8f129f

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5505.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            406B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            37512bcc96b2c0c0cf0ad1ed8cfae5cd

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            edf7f17ce28e1c4c82207cab8ca77f2056ea545c

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\@AE41DB.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            7cd76ff367fb5f5f08c50dad034f65e6

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            37096bdb613d7400f820ef36b58b861306504877

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            e7a1c9fa2a8166e78f2f3bd732720f6e0c7c36289686e904f6fa52877fb7364f

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            813d95e5f9ff94288de9e3444adee81ccd17e531d524730b3d72fc4f0f76d1f2836922285521d1d6f8e4b12d9b87c4532b8de512f2fd771e07341bd94fb919ce

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aut9971.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            125KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            4e43a95d88010accdf635bf6ade9ad05

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            1c7136b3402af411b66288e1f460b9c7447850c3

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            b6b7ede5e5de9c5bf60f8775fcfb1f5bc0faf4aa99c2404fd2090dcfa75f6408

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            090d97c64ebb887353a7386532cec5ca7a84f84c831fc4213d42ce29aed607e535409f2d446dd552cad1d121ac960bb099603c05acb3f1bd168ab1983a5a9c38

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4825.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            df2c63605573c2398d796370c11cb26c

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            efba97e2184ba3941edb008fcc61d8873b2b1653

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            07ffcde2097d0af67464907fec6a4079b92da11583013bae7d3313fa32312fe8

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            d9726e33fcfa96415cc906bdb1b0e53eba674eaf30ed77d41d245c1c59aa53e222246f691d82fa3a45f049fbf23d441768f9da21370e489232770ad5ae91d32f

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4835.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            229KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            6f90e1169d19dfde14d6f753f06c862b

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            e9bca93c68d7df73d000f4a6e6eb73a343682ac5

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4846.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            f558c76b0376af9273717fa24d99ebbf

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            f84bcece5c6138b62ef94e9d668cf26178ee14cc

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4847.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            126KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            02ae22335713a8f6d6adf80bf418202b

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            4c40c11f43df761b92a5745f85a799db7b389215

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4857.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            89KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            09203a9741b91f3a9ed01c82dcb8778d

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            13e6f3fb169cd6aa5e4d450417a7e15665a2e140

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4868.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            9a27bfb55dd768ae81ca8716db2da343

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            55da0f4282bd838f72f435a5d4d24ac15b04482b

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            172KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            2634fa3a332c297711cb59d43f54ffce

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            8e2b68d0ee4e792efb1945ba86eceb87f07087d2

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp487A.tmp
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            276KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            e07c6a9e595f045fadc463dfda44ab16

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            e6b199272ade02613f2003c365a4cb1487431e23

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            276KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            75c1467042b38332d1ea0298f29fb592

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            f92ea770c2ddb04cf0d20914578e4c482328f0f8

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            172KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            daac1781c9d22f5743ade0cb41feaebf

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            e2549eeeea42a6892b89d354498fcaa8ffd9cac4

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            62d5073f966bc2e0d6ab7028b86d2f6b

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            1b5f9af9a303e7f410023aba8fdd218e192b0215

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            bc29b857b5f59d737306ba09481af4bae54435c892f4e2e0d5b6e71d64883b9e

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            a0f25ce532c97a359fe00fb01b26986930337e1df53fcba35141fb4bba89cf911e8d3301e510dd3a735887021f1a7ff467c214820dbd872c9da0a14279e999c3

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            129B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            d1073c9b34d1bbd570928734aacff6a5

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            78714e24e88d50e0da8da9d303bec65b2ee6d903

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            125B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            3cf1f0753538c90d3a79e802e7ca88e4

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            606b28698cb6e830130ccd4d2d541754c940426d

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            98d1d1dcdc550e484a624ad0596ab1a23d4a6b9ba518e4d881d6b11aa3ef488f

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            09344affd3c1fc2a995f574bf81a5e00c975f8cb07873bfc4bbb0447d1bf73780bb5ba4be6cfca454b198d617304865ca4d21540cda36d8ef59ebc4b232c73df

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            196B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            a68ad56cf8a29c03f1655169fa7b015b

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            2a8037e3c9f016e392919f94f9bb271bf0fa58e4

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            a062e0c95bf211a6e6a06489487d6f0f03646b88900e6de2cee92fdd1d0a82ab

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            039cbec65564a13d0e95358c7909aeeff47ed7c83691941825c0c7e5ff6a2b5ac9367623c8cd44bbc427e358023697083bb5fdb7731531143f073e025dbb9ef4

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            102B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            3ca08f080a7a28416774d80552d4aa08

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            0b5f0ba641204b27adac4140fd45dce4390dbf24

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            388KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            8d7db101a7211fe3309dc4dc8cf2dd0a

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            6c2781eadf53b3742d16dab2f164baf813f7ac85

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\INF\Autoplay.inF
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            234B

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            7ae2f1a7ce729d91acfef43516e5a84c

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            ebbc99c7e5ac5679de2881813257576ec980fb44

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mscaps.exe
                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                            78d3c8705f8baf7d34e6a6737d1cfa18

                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                            9f09e248a29311dbeefae9d85937b13da042a010

                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                            2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905

                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                            9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609

                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                          • memory/388-948-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/544-616-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/544-642-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/616-721-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/616-695-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/976-391-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1276-694-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1276-669-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1372-667-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1372-643-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1468-972-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1508-872-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1704-821-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/1884-499-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2120-13-0x0000000010000000-0x0000000010015000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-759-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-974-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-682-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-936-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-579-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-809-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-349-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-532-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-709-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-630-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-1012-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-487-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-848-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-886-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2200-426-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2256-561-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2304-591-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2636-771-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2692-615-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2728-795-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-393-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-438-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/2860-467-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3100-529-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-935-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-629-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-808-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-531-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-758-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-1011-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-835-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-347-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-486-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-973-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-885-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-578-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-708-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-425-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3224-668-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/3320-1024-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4268-745-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4364-898-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4388-922-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4648-847-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4648-822-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4868-998-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4948-408-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                          • memory/4948-72-0x0000000000400000-0x000000000048D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                            564KB

                                                                                                                                                                                                                                                                                                                                                                            Download