Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

GTA 6 Buil...ll.exe

windows7-x64

9

GTA 6 Buil...ll.exe

windows10-1703-x64

9

GTA 6 Buil...ll.exe

windows10-2004-x64

9

GTA 6 Buil...ll.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    717s
  • max time network
    715s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 11:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GTA 6 Builder-Install.exe

  • Size

    13.2MB

  • MD5

    76c24a289ef8e97b890585d7727ac384

  • SHA1

    4f5e5bbd4d24f3d475bd77b30c9f6f62d96f3d64

  • SHA256

    ecf92b4d201eb858e63d6dd03937de3255ac7bc6f57264753f53306a3a9d7aa2

  • SHA512

    0d54872ea7cc28f3de62a40eb50b06ace92a4e77144608f2d9e51d4ca60fec5d485bd6bceba8d1f4acea8b20670233a412df4cf5bf29eac17dc723b23ee1128d

  • SSDEEP

    196608:FexmCr8ywE5Ec0BY36vhmYzr9bD3xRlLlPIIHtOC21rGY+GVz3mAp:UPr8ycYqv9bDflLlggOd+M1p

Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 38 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 38 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 37 IoCs
  • Runs ping.exe 1 TTPs 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe
    "C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FuUFRpewDb.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:1380
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:400
          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
            "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5108
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lbSQETZDjd.bat"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4528
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:1924
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  6⤵
                    PID:2120
                  • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                    "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3460
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ege7x4f51h.bat"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3348
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        8⤵
                          PID:2876
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          8⤵
                            PID:4268
                          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                            "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                            8⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3808
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WJ1wtP2ROC.bat"
                              9⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4236
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                10⤵
                                  PID:908
                                • C:\Windows\system32\PING.EXE
                                  ping -n 10 localhost
                                  10⤵
                                  • Runs ping.exe
                                  PID:4028
                                • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                  "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                  10⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2024
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CRpzSJfEpm.bat"
                                    11⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3752
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      12⤵
                                        PID:2760
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        12⤵
                                          PID:1460
                                        • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                          "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                          12⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:652
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\htx2mBafAs.bat"
                                            13⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2120
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              14⤵
                                                PID:3904
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                14⤵
                                                • Runs ping.exe
                                                PID:1972
                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                14⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:544
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gzlPEas6c9.bat"
                                                  15⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:724
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    16⤵
                                                      PID:5116
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 10 localhost
                                                      16⤵
                                                      • Runs ping.exe
                                                      PID:3296
                                                    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                      16⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1532
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KWBHRiM3K6.bat"
                                                        17⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4036
                                                        • C:\Windows\system32\chcp.com
                                                          chcp 65001
                                                          18⤵
                                                            PID:2900
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            18⤵
                                                              PID:4796
                                                            • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                              18⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1140
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat"
                                                                19⤵
                                                                  PID:4608
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    20⤵
                                                                      PID:4516
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping -n 10 localhost
                                                                      20⤵
                                                                      • Runs ping.exe
                                                                      PID:4384
                                                                    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                      20⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2704
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ege7x4f51h.bat"
                                                                        21⤵
                                                                          PID:4212
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 65001
                                                                            22⤵
                                                                              PID:2316
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              22⤵
                                                                                PID:4244
                                                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                22⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:880
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PTUnOlLS5m.bat"
                                                                                  23⤵
                                                                                    PID:2688
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      chcp 65001
                                                                                      24⤵
                                                                                        PID:1460
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        24⤵
                                                                                          PID:4924
                                                                                        • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                          24⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4036
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OEffu0Lctr.bat"
                                                                                            25⤵
                                                                                              PID:4640
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                26⤵
                                                                                                  PID:5088
                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  26⤵
                                                                                                  • Runs ping.exe
                                                                                                  PID:4308
                                                                                                • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                  26⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3316
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k1znnYI5tX.bat"
                                                                                                    27⤵
                                                                                                      PID:560
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        28⤵
                                                                                                          PID:1572
                                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                          28⤵
                                                                                                            PID:1260
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                            28⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1520
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cHG0lItX2O.bat"
                                                                                                              29⤵
                                                                                                                PID:5116
                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                  chcp 65001
                                                                                                                  30⤵
                                                                                                                    PID:4832
                                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                    30⤵
                                                                                                                      PID:2384
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                      30⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1028
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j7nAGxaWLn.bat"
                                                                                                                        31⤵
                                                                                                                          PID:2420
                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                            chcp 65001
                                                                                                                            32⤵
                                                                                                                              PID:1620
                                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                              32⤵
                                                                                                                                PID:2984
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                32⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2712
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat"
                                                                                                                                  33⤵
                                                                                                                                    PID:1288
                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                      chcp 65001
                                                                                                                                      34⤵
                                                                                                                                        PID:1968
                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                        ping -n 10 localhost
                                                                                                                                        34⤵
                                                                                                                                        • Runs ping.exe
                                                                                                                                        PID:1948
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                        34⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4584
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nUe3m5ImHN.bat"
                                                                                                                                          35⤵
                                                                                                                                            PID:5012
                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                              chcp 65001
                                                                                                                                              36⤵
                                                                                                                                                PID:4572
                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                ping -n 10 localhost
                                                                                                                                                36⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:5028
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                36⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2396
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
                                                                                                                                                  37⤵
                                                                                                                                                    PID:428
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      38⤵
                                                                                                                                                        PID:4312
                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                        38⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:4864
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                        38⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3968
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat"
                                                                                                                                                          39⤵
                                                                                                                                                            PID:1124
                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                              chcp 65001
                                                                                                                                                              40⤵
                                                                                                                                                                PID:1232
                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                40⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:4564
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                40⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4064
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ege7x4f51h.bat"
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:1172
                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                      chcp 65001
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:1956
                                                                                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                        42⤵
                                                                                                                                                                          PID:1612
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                          42⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:4804
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sRyZj7GC23.bat"
                                                                                                                                                                            43⤵
                                                                                                                                                                              PID:4552
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                44⤵
                                                                                                                                                                                  PID:1400
                                                                                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                  44⤵
                                                                                                                                                                                    PID:4788
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                    44⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:4200
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAOW7F8RUK.bat"
                                                                                                                                                                                      45⤵
                                                                                                                                                                                        PID:4776
                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                          46⤵
                                                                                                                                                                                            PID:5012
                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                            46⤵
                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                            PID:1460
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                            46⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:3928
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
                                                                                                                                                                                              47⤵
                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tgniDsG2Ey.bat"
                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                            PID:3916
                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:3928
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\htx2mBafAs.bat"
                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\26i24I6rG0.bat"
                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                        PID:1832
                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat"
                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:3488
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:1784
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KrnlOsdLyH.bat"
                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                      PID:5260
                                                                                                                                                                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ojUBGqHdSI.bat"
                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                PID:5672
                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xEBZwnpYP.bat"
                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                          PID:6120
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat"
                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                              PID:1400
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                    PID:5392
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lbSQETZDjd.bat"
                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                        PID:5812
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                            PID:5972
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                              PID:6000
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nUe3m5ImHN.bat"
                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OEffu0Lctr.bat"
                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                          PID:5540
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XKxUoGu8Hi.bat"
                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                  PID:4844
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                      PID:5280
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                        PID:2772
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"
                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j7nAGxaWLn.bat"
                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                                                                                                                PID:1160
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                  PID:6028
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Runtime64.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Drops startup file
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4592

                                                                                                                                                                          Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ComHostSvc.exe.log
                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9b88ec4146b97a654b26aa3134d72f7b

                                                                                                                                                                            SHA1

                                                                                                                                                                            0310fd2b3d9c4a2430884cb3b934944c1795c4f7

                                                                                                                                                                            SHA256

                                                                                                                                                                            da8f8d6a1502af37be9b19b9d83bafe15200d9dd2a6ed80513ac9e492b2bcb9d

                                                                                                                                                                            SHA512

                                                                                                                                                                            bdc298b59f5635f5f0d418ba0e278e64a6adc1632787cd18120d3038d70e2e39305f25a7aeb1c7c73711eb23a3aa4236430cc8ec379791cb4e265ea273c32e98

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\26i24I6rG0.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            70b173b41effcebed7aae1dd8fca421e

                                                                                                                                                                            SHA1

                                                                                                                                                                            10339aeca89270087370f26a33ebe2a38898c7af

                                                                                                                                                                            SHA256

                                                                                                                                                                            cd4cea46ad9f1768665662fbe72865c297da196867a5b640d37cdf43989567b7

                                                                                                                                                                            SHA512

                                                                                                                                                                            f5c23d54bbbcb4e7016199117a27eb8bfcb82b418a6a968d839355724265ae7ed90afd27d9113516ec59109c659e22befd89372c37dc20ed2871b74f75f9901b

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            322c57863d8ce49a3d202a77e9060e62

                                                                                                                                                                            SHA1

                                                                                                                                                                            a25ad6d9f073bcf8406fedcb456d26374c3cb959

                                                                                                                                                                            SHA256

                                                                                                                                                                            0b41dc6a8d216bc30b88438a5cac2d25fc909bd9f1563491b4374d41cda00fef

                                                                                                                                                                            SHA512

                                                                                                                                                                            34f6c1afcbe216d291caaec8b0bb98dc157b41d5956971d450cc10e1244a95079346beadc40c1b688bf9013629d13d21b1ca2d89751e5448d503a137b709cc7b

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CRpzSJfEpm.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            246ce5108e3bb3941e95492e6fbc477e

                                                                                                                                                                            SHA1

                                                                                                                                                                            768aebc567c3f9d1009986196f462253090e3d06

                                                                                                                                                                            SHA256

                                                                                                                                                                            8f77fd74b2f62d2b6f513da348d84c3ecae73593261ad5f1942860eb3e50f23d

                                                                                                                                                                            SHA512

                                                                                                                                                                            96a64b30a2557b2f5677354042aad43995a8dc5f44069f30c6200e40fcf44e9342519ac3c779483852c8b45b356165a8894168c1c7d006eae97669c9902c4936

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            2.0MB

                                                                                                                                                                            MD5

                                                                                                                                                                            31e5e3ac5a03d60d67188b6b0c3d152b

                                                                                                                                                                            SHA1

                                                                                                                                                                            41e831bc8b0c314a46d17492ded7b6b587d66db2

                                                                                                                                                                            SHA256

                                                                                                                                                                            dc73ce51066fdcd5f0c7c88fd6fdfb9a4a3722ebe3d2def1dc593fbc1af9e467

                                                                                                                                                                            SHA512

                                                                                                                                                                            64837c66af3f63c214ff8f466266f3dea1cf135d54ccaaf5c06fa13763045d79220f88d09ca49a36668d7e1f506bc74c9a2b8de0ec77aac272b0e1466aa168c2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Ege7x4f51h.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            ea05abadab75feef9604be0872bc1839

                                                                                                                                                                            SHA1

                                                                                                                                                                            9529b42a8f947c8292b1c8af548a7556b66288fe

                                                                                                                                                                            SHA256

                                                                                                                                                                            1a0a541f935288a0555bc2bf2744cf5f108bf36c6651f701a0decf87dfeb729f

                                                                                                                                                                            SHA512

                                                                                                                                                                            1d0ccd7ace7fb50ae0e946253138a7bd274fc18b14984d9452406c9b9feb5dd0c9e25c8b655fbadd044ef3731ea82079a70ef4fdbf1c12676481a6f190c2a8a2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FuUFRpewDb.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            26be6f164d53eaf0287e7bfc55f09818

                                                                                                                                                                            SHA1

                                                                                                                                                                            eea36e322c3bffd401c1c1eee675bbafd37f71ea

                                                                                                                                                                            SHA256

                                                                                                                                                                            94987fe891f0bc1e4f9bcd46ba5e4de52d9318c2f850e020a8ae001536ed831a

                                                                                                                                                                            SHA512

                                                                                                                                                                            1dfb6fb3113085c0b796cc18b03e143552d470f8ae9057caebf70dc085945e3e6c47b9465c22efd0b925f7f6828ee69e6cbc3d95b95448eb5d843c9962b613a7

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            7bc2e1b013cf4453d6e6ee709c874922

                                                                                                                                                                            SHA1

                                                                                                                                                                            6947efd91ea7afdaf65cb4f83c080641ccf7bf35

                                                                                                                                                                            SHA256

                                                                                                                                                                            84dc3e7e144b1184a2171176a89777a821a1a8e0f6de9d41a6c2637079955496

                                                                                                                                                                            SHA512

                                                                                                                                                                            6a5f4e285c35e34e36dea0001666c0508e1f4f8dc58f5387e45389a0d20430c5eab50af88c1a0df03c016e3cb65254543b95ede44773c485ef4e86d874819566

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KWBHRiM3K6.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            7efe39d3b61705606f404942f525c606

                                                                                                                                                                            SHA1

                                                                                                                                                                            7dd330330b1b65425ec3a472ad631b11f8592685

                                                                                                                                                                            SHA256

                                                                                                                                                                            522cb84a0b86c03fa9cf57c55dfbc98a16a5d4d4761d5767f30a5994718086e2

                                                                                                                                                                            SHA512

                                                                                                                                                                            a8c8363055040fdefc1ba35ce39a93c8ff6b0c35e88f837b0d1cb7d377e524dcd216b94f54e4189b601a1324c7e62f7788441050bdd3f30bab4b52d07d5e6101

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KrnlOsdLyH.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            f3cf68b58841e3a4fc5fda6865ac8d61

                                                                                                                                                                            SHA1

                                                                                                                                                                            9932da3284614595fa4bda64c08284a9b8023dc9

                                                                                                                                                                            SHA256

                                                                                                                                                                            85a11dbadba918d1f81a78aadca19e401e37c5c0779cd49210178bae48b672f3

                                                                                                                                                                            SHA512

                                                                                                                                                                            d39b38d4a9dde168f8ccb3d6049e66d2681f8b1b97f6ebb8e40c6b177f30effa7451b158d42a831cd5910b10fbad5104cd3b3dcdce789f5694c868dd919d5146

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OEffu0Lctr.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            e0df16c9751ef4387248d2a6ed6db577

                                                                                                                                                                            SHA1

                                                                                                                                                                            5ec6d8da214730a3ff70b2c834ed4feea44a77ee

                                                                                                                                                                            SHA256

                                                                                                                                                                            0891632876f615024a5fff1ec56e4b97a03e087a885ed571f019e86cdeba7a3d

                                                                                                                                                                            SHA512

                                                                                                                                                                            b3f63d2dc35eefb2ac634cfd6943422b9c774baa200c093b3577aa933d5bf2d0d615daa4deef26fc6f1c07bd5abbf9c34ca32d89c167597089a027716c4b866f

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PTUnOlLS5m.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            2d762b0dbc13df8cdcd53511380692c3

                                                                                                                                                                            SHA1

                                                                                                                                                                            4f42b7b332103b033ba85c19c99a30ea3d0becd5

                                                                                                                                                                            SHA256

                                                                                                                                                                            f8121fe4ac5cb7e9a74c72f92d3284f4f7e1f9c166a13f03fcbafc1433a92694

                                                                                                                                                                            SHA512

                                                                                                                                                                            b4ef60b8a2683b7163ffdb4b14fa86d5d99061c46d61080efdbf31e992a5a90ad202b67ca2a092885b342d538aeeb62b20ca2f9bdac889e6d55320ba304f03f9

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Runtime64.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            11KB

                                                                                                                                                                            MD5

                                                                                                                                                                            da23f44a96e6aa3a8b80f1cc40169dae

                                                                                                                                                                            SHA1

                                                                                                                                                                            9c5ff4215e46407da34524ce4f26841aa2c842c6

                                                                                                                                                                            SHA256

                                                                                                                                                                            2d86ab0d97a265aa7b465439ac97c0c6b428a3bdc18000625f3fd66c07ff6f70

                                                                                                                                                                            SHA512

                                                                                                                                                                            ccf6056c176a98e2f235f22667ea1497191a3cb373fc63632467de6255493c98fcb315d55a634cd0bb10e6087d832f46d0712fb3661dd3786bd9fe360981a035

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WJ1wtP2ROC.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            be6a0172806f939f6d65c1a34ac07d5d

                                                                                                                                                                            SHA1

                                                                                                                                                                            71e01b9ba00af731e36b7735ee1bf6acb4a38552

                                                                                                                                                                            SHA256

                                                                                                                                                                            633071b3af8e4c99022fe1dcb8fdcae6a8e64faefa3c4a00645c6d3b7954c2fc

                                                                                                                                                                            SHA512

                                                                                                                                                                            f747cdab56785c58f4fa9bb2593a3281bd0b3f4607b744a6bc9206b9c773397e6477ebf5a839a48cce3cafc8ec4a2a5fac1b0db284b729b7eba871ed003494aa

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cHG0lItX2O.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            d93e70ebecb1a4eff94f3f2e7c7b1448

                                                                                                                                                                            SHA1

                                                                                                                                                                            c85746b4b5783ef5d75b044061ba39d97da0b47a

                                                                                                                                                                            SHA256

                                                                                                                                                                            eedf311fd9a72ab67ccb5680ca1e3c385ddd34bf8331b25ae2ba0962fcd2d096

                                                                                                                                                                            SHA512

                                                                                                                                                                            3d392862ec5d82c283d36d54c6b794ce6056ce41c0b76aea94fd612e93aa7707ca6431db42b63509a2152a15d6322dd828731e510e6120ab36e76bdbccad2575

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            17aea2b28157abf6b8fa7278b32764e1

                                                                                                                                                                            SHA1

                                                                                                                                                                            39f33bdc96e144d5acad16bb1abb8a1e282568e6

                                                                                                                                                                            SHA256

                                                                                                                                                                            f4823b511bb600cd09ff9a3ff1ae1c1fbd0bf58907738d0dc7875e7b8bf988b9

                                                                                                                                                                            SHA512

                                                                                                                                                                            64876eda0ce54832335ac631923be94d0c98a426a4fa5a7c729cefd60564aa653369ff5bfeaa8f1f5978c8a41e8e259b92da790f74acf8b15280083c83fe25ff

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\gzlPEas6c9.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            eeb78a83bfd75ff0e222bd8bb3abe55b

                                                                                                                                                                            SHA1

                                                                                                                                                                            94f103d6757106b53a12a696feca616c2afb7114

                                                                                                                                                                            SHA256

                                                                                                                                                                            ecb191bb492ef29a4ae05aea654fe847289b680282706d293e303dec6de60f09

                                                                                                                                                                            SHA512

                                                                                                                                                                            c5c1a6b29ec686a0b0db31a40134246bccaa79524ac25af957b1549b5973f114dcf964d513e7e3f2ee9c601234918eca308069120831b3f4c334387218e1d17c

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\htx2mBafAs.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            8208c50fd5631d00ac079ef07de774af

                                                                                                                                                                            SHA1

                                                                                                                                                                            9aeb590bd69972147701ddcd6e081fa9e996ff96

                                                                                                                                                                            SHA256

                                                                                                                                                                            c4f5a944e564794b8e1aeb776870503fa83733cee24b103511df6601ed9b5cfd

                                                                                                                                                                            SHA512

                                                                                                                                                                            f699755af2ae4964b64996a006f24fefd88a1b9fc3594e4c83e8bd1c147fb08ff9b9c3dab76d27b74e2fd16883401b6555dea3a02a00f3c49648db2eed523489

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\j7nAGxaWLn.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            4f347f8c40ce0b8695630df95cf131cf

                                                                                                                                                                            SHA1

                                                                                                                                                                            dcbfb6f0f1563a35c9083cfa8e2f664475b17133

                                                                                                                                                                            SHA256

                                                                                                                                                                            c440e0b142a4ff6f3296c0c0a4f33de6a1d599b87f844b442102f7f15387f4c0

                                                                                                                                                                            SHA512

                                                                                                                                                                            9a07dca6afe79e118a97367e9afa02ed3f18d9b863af77dd70f5bde7c3726f7c32c8be990129e28a3d3fda0552de60c78e59efa49240ab495c8abae03d63c4d1

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\k1znnYI5tX.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            528192bd213ed2bd6e1fd75b0c2e7313

                                                                                                                                                                            SHA1

                                                                                                                                                                            d4ee3279215477bd6c84b65f3ccfa97c9f4d78fc

                                                                                                                                                                            SHA256

                                                                                                                                                                            71f462dd6f8b27e0045c9bf073c5e1c7e380cdc4aad762fa63b7762b38583aa3

                                                                                                                                                                            SHA512

                                                                                                                                                                            8da2e7f9ed13788fa66ff83671b3ca4a074824e4692b77d03330426f44bd509fc7e275e0740183fbaddcfe4119d4e5087e1e5b4a43d561c16ccfbd83fde9a8f4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\lbSQETZDjd.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            390d8a017e4f0961b5c38d225fd606ab

                                                                                                                                                                            SHA1

                                                                                                                                                                            9ef551d48ddaa73bcab665488e2b1f4402fba142

                                                                                                                                                                            SHA256

                                                                                                                                                                            a70c55349ab82b07f350ec235357f3f47460d3edf234ae05f46dfcad8faf2f4e

                                                                                                                                                                            SHA512

                                                                                                                                                                            aaedc5b7563a6fc55ef613d5c96220b38fc4583e51758f90c5e26f0f76dad35526cfeb5facd0802f2e9d89cb5a664feb915e6f1cbe2ae4df4d4df418ba26797f

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            eee7b1ee1e4effcd216f9da7e7b6e692

                                                                                                                                                                            SHA1

                                                                                                                                                                            5242913ef50dc7eecbdc749ef736c1113280f81d

                                                                                                                                                                            SHA256

                                                                                                                                                                            fdf7bf49becb3298f7dc547c7a020afd932b229b5097c6ec246e71bb2092c58a

                                                                                                                                                                            SHA512

                                                                                                                                                                            0a32e312c26f5d97bfe9b3c9c7b8731f7af83e46161e6a36283d7fc390bf17d28b44c1985c28e963f0157b5b3744342f2e7865bab21ce4a3213c5f481adaecf8

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\nUe3m5ImHN.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            c01c1eae26486cecd61c410d7322bf6c

                                                                                                                                                                            SHA1

                                                                                                                                                                            30e50a69cfd4603cbce764e7aea0760befe38edd

                                                                                                                                                                            SHA256

                                                                                                                                                                            5bdadd54c4aeb16247ff05d421ac461f60ac130ef1eab7e0d108a0ef7b963c84

                                                                                                                                                                            SHA512

                                                                                                                                                                            557b4c4544f90971ca2b1387dd527d16609ceff483c957b942cc8e111ddc2ec7a7a9f9cf6fc6ab4f294d8fed79d99c2cae42bd45fd164cc21e1f51f181bbc932

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ojUBGqHdSI.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            dd187b750bbfa67f2f6f8fb000dcce21

                                                                                                                                                                            SHA1

                                                                                                                                                                            3d3c5a0a36e157ff523ee546b749caf53d066c4c

                                                                                                                                                                            SHA256

                                                                                                                                                                            5fe2dcdb92e00090116955d88a2ef2c95194a8ae1874f1f809f16bd86e9bfd03

                                                                                                                                                                            SHA512

                                                                                                                                                                            aafaaf955003b512ea8f7a1440e8e12d14c4b1323b88dae8169257fe0f2f29a8f105ca34ee1a9fb41f468b512c1f2c2859d04285c51685de8c6e5b43058230f3

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sRyZj7GC23.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            224B

                                                                                                                                                                            MD5

                                                                                                                                                                            ac0f3b77be7e2e3e1ff3b5325a8c91fa

                                                                                                                                                                            SHA1

                                                                                                                                                                            5c277eb6ee3c8040a3a02c46c8d9b8f556ddcfa0

                                                                                                                                                                            SHA256

                                                                                                                                                                            0ede29e8e2ae4f8b3259a0df6796d3706374892501030930124eb22ac3181b65

                                                                                                                                                                            SHA512

                                                                                                                                                                            1dda4f3fd1110c224e772e7dec7d40d858923698f8a750da4a6fa7e6d4957ce412e27af6b90afcc7f535a44e88af375c79689c1a71702b97f282bfa2d6fde1ce

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tgniDsG2Ey.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            7ab7c2c0a22a215e494267885a61d054

                                                                                                                                                                            SHA1

                                                                                                                                                                            538aba3f8bea7805d43280b7411360001daff33c

                                                                                                                                                                            SHA256

                                                                                                                                                                            ae8cbdef908ef2336edcc6c51af6a414f44f0a0d6bd1326a1b17efc1fcee183a

                                                                                                                                                                            SHA512

                                                                                                                                                                            fe3c1ed1297de64b3f66bff7abf28cd2d1ff1e5bdee0eb7a7f201794bb3d0448d8877fcaacae30f0d622664121e2eb7c8807f16437b6aaf4ce54657f34dadd81

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\xAOW7F8RUK.bat
                                                                                                                                                                            Filesize

                                                                                                                                                                            176B

                                                                                                                                                                            MD5

                                                                                                                                                                            2ddebcab0a862446ddd8e0d1c40f0596

                                                                                                                                                                            SHA1

                                                                                                                                                                            ddcc0ba8f4ca5994ddb07c84ea4946cd949a317a

                                                                                                                                                                            SHA256

                                                                                                                                                                            d2e69a9520505577abaf9b72b18cd0553f2692496ea9fa3f67622fa89a03a1ef

                                                                                                                                                                            SHA512

                                                                                                                                                                            c85586ba0dcd5e8faeac979f60cd8ede4af8bebbbd31457d7a14001f035dad7231b6228e67177e3d450b4a8aa2e45bae8b5c760532bfe196ca14dec55386894d

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • memory/544-154-0x000000001C310000-0x000000001C35E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/544-153-0x000000001C190000-0x000000001C2FA000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/652-137-0x000000001C340000-0x000000001C4AA000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/652-138-0x000000001C4C0000-0x000000001C50E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/880-214-0x000000001D160000-0x000000001D1AE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1028-274-0x000000001D140000-0x000000001D18E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1140-184-0x000000001CD70000-0x000000001CDBE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1520-259-0x000000001CEB0000-0x000000001CEFE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1532-169-0x000000001CFF0000-0x000000001D03E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1732-469-0x000000001CF60000-0x000000001CFAE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1784-484-0x000000001D600000-0x000000001D64E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1852-1-0x0000000077384000-0x0000000077386000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            8KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1852-0-0x0000000000400000-0x00000000021E4000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            29.9MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/1852-27-0x0000000000400000-0x00000000021E4000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            29.9MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2024-122-0x000000001CB00000-0x000000001CB4E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2024-121-0x000000001C990000-0x000000001CAFA000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2396-319-0x000000001D1A0000-0x000000001D1EE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2556-409-0x000000001CE90000-0x000000001CEDE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2612-565-0x000000001D2F0000-0x000000001D33E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2704-199-0x0000000002B90000-0x0000000002BDE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/2712-289-0x000000001D010000-0x000000001D05E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3316-244-0x000000001D480000-0x000000001D4CE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3460-89-0x000000001CD00000-0x000000001CE6A000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3460-90-0x000000001CE70000-0x000000001CEBE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3808-105-0x000000001C3D0000-0x000000001C53A000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3808-106-0x000000001C550000-0x000000001C59E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3928-424-0x000000001D5E0000-0x000000001D62E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3928-394-0x000000001CA60000-0x000000001CAAE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/3968-334-0x000000001C970000-0x000000001C9BE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4036-229-0x000000001C8F0000-0x000000001C93E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4064-349-0x000000001D2E0000-0x000000001D32E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4200-379-0x000000001C860000-0x000000001C8AE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-49-0x000000001C030000-0x000000001C132000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.0MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-26-0x00007FFD5B5C3000-0x00007FFD5B5C5000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            8KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-44-0x000000001B540000-0x000000001B54C000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            48KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-56-0x000000001C790000-0x000000001C7DE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-33-0x000000001B4F0000-0x000000001B50C000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            112KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-48-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            48KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-42-0x000000001BAC0000-0x000000001BAD2000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-55-0x000000001C030000-0x000000001C132000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.0MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-34-0x000000001BA70000-0x000000001BAC0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            320KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-40-0x000000001B530000-0x000000001B53E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            56KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-36-0x000000001B510000-0x000000001B528000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            96KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-38-0x0000000002AC0000-0x0000000002ACE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            56KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-28-0x00000000007D0000-0x00000000009D6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.0MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4240-46-0x000000001B550000-0x000000001B55E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            56KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4572-454-0x000000001D210000-0x000000001D25E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4584-304-0x000000001D080000-0x000000001D0CE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4592-29-0x0000023900A80000-0x0000023900A88000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            32KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4592-31-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4592-58-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4804-364-0x000000001D320000-0x000000001D36E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/4864-439-0x000000001CCD0000-0x000000001CD1E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5108-73-0x000000001C330000-0x000000001C432000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.0MB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5108-74-0x000000001B9D0000-0x000000001BA1E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5124-526-0x000000001CE90000-0x000000001CEDE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5332-499-0x000000001D2F0000-0x000000001D33E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5532-539-0x000000001D300000-0x000000001D34E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5580-591-0x000000001CCD0000-0x000000001CD1E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5776-513-0x000000001CD70000-0x000000001CDBE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5804-552-0x000000001B6C0000-0x000000001B70E000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download

                                                                                                                                                                          • memory/5896-578-0x000000001C780000-0x000000001C7CE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            312KB

                                                                                                                                                                            Download