Overview

overview

10

Static

static

10

DCRatBuild.exe

windows10-2004-x64

10

DCRatBuild.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    576s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 19:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DCRatBuild.exe
  • Size 1.1MB
  • Sample260806-x5b4payglc
  • SHA256 3bfabec207aec07e0ee154e8d0047c69c52801a5b3fb6a05f8d2fe3102c25a7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryexecutiondcratinfostealerpersistenceransomwareratspyware

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\mshyperWinCommon\sq3hmjfP.vbe"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\mshyperWinCommon\ZghAVpTvHKXvaHZHZwjLT4B.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5964
        • C:\mshyperWinCommon\BlockWebdriver.exe
          "C:\mshyperWinCommon\BlockWebdriver.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FFGwGvdk9Y.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4556
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:2904
              • C:\Windows.old\fontdrvhost.exe
                "C:\Windows.old\fontdrvhost.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3324
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\mshyperWinCommon\sihost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1100
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\mshyperWinCommon\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:996
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\mshyperWinCommon\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:920
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\mshyperWinCommon\Registry.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4600
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\mshyperWinCommon\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:5744
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\mshyperWinCommon\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3288
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3332
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1312
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\uk-UA\OfficeClickToRun.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1292
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:936
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:5996
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows.old\fontdrvhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:6056
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2120
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1964
    • C:\mshyperWinCommon\sihost.exe
      "C:\mshyperWinCommon\sihost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1212
    • C:\Windows\uk-UA\OfficeClickToRun.exe
      "C:\Windows\uk-UA\OfficeClickToRun.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:4884
          • C:\Windows\uk-UA\OfficeClickToRun.exe
            "C:\Windows\uk-UA\OfficeClickToRun.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4548
      • C:\Windows.old\fontdrvhost.exe
        "C:\Windows.old\fontdrvhost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3936
      • C:\mshyperWinCommon\Registry.exe
        "C:\mshyperWinCommon\Registry.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2916
      • C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe
        "C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5928
      • C:\mshyperWinCommon\sihost.exe
        "C:\mshyperWinCommon\sihost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3088
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\System32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            3⤵
              PID:2336
            • C:\mshyperWinCommon\sihost.exe
              "C:\mshyperWinCommon\sihost.exe"
              3⤵
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5364
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
                4⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4240
                • C:\Windows\System32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  5⤵
                    PID:1488
                  • C:\mshyperWinCommon\sihost.exe
                    "C:\mshyperWinCommon\sihost.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4184
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VAw4LgrmW.bat"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2364
                      • C:\Windows\System32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        7⤵
                          PID:4920
                        • C:\mshyperWinCommon\sihost.exe
                          "C:\mshyperWinCommon\sihost.exe"
                          7⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4748
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat"
                            8⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4232
                            • C:\Windows\System32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              9⤵
                                PID:4540
                              • C:\mshyperWinCommon\sihost.exe
                                "C:\mshyperWinCommon\sihost.exe"
                                9⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4956
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat"
                                  10⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:120
                                  • C:\Windows\System32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    11⤵
                                      PID:1180
                                    • C:\mshyperWinCommon\sihost.exe
                                      "C:\mshyperWinCommon\sihost.exe"
                                      11⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:5660
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat"
                                        12⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5600
                                        • C:\Windows\System32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          13⤵
                                            PID:5840
                                          • C:\mshyperWinCommon\sihost.exe
                                            "C:\mshyperWinCommon\sihost.exe"
                                            13⤵
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:4580
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat"
                                              14⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2228
                                              • C:\Windows\System32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                15⤵
                                                  PID:4036
                                                • C:\mshyperWinCommon\sihost.exe
                                                  "C:\mshyperWinCommon\sihost.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4020
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"
                                                    16⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5924
                                                    • C:\Windows\System32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      17⤵
                                                        PID:5808
                                                      • C:\mshyperWinCommon\sihost.exe
                                                        "C:\mshyperWinCommon\sihost.exe"
                                                        17⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5644
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat"
                                                          18⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2676
                                                          • C:\Windows\System32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            19⤵
                                                              PID:3400
                                                            • C:\mshyperWinCommon\sihost.exe
                                                              "C:\mshyperWinCommon\sihost.exe"
                                                              19⤵
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3140
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat"
                                                                20⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3300
                                                                • C:\Windows\System32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  21⤵
                                                                    PID:4664
                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                    21⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3292
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat"
                                                                      22⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2932
                                                                      • C:\Windows\System32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        23⤵
                                                                          PID:4656
                                                                        • C:\mshyperWinCommon\sihost.exe
                                                                          "C:\mshyperWinCommon\sihost.exe"
                                                                          23⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4340
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
                                                                            24⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:576
                                                                            • C:\Windows\System32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:2600
                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                25⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2632
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"
                                                                                  26⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:548
                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    27⤵
                                                                                      PID:4420
                                                                                    • C:\mshyperWinCommon\sihost.exe
                                                                                      "C:\mshyperWinCommon\sihost.exe"
                                                                                      27⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4684
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat"
                                                                                        28⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2888
                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          29⤵
                                                                                            PID:4380
                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                            29⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4904
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat"
                                                                                              30⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4264
                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                31⤵
                                                                                                  PID:4740
                                                                                                • C:\mshyperWinCommon\sihost.exe
                                                                                                  "C:\mshyperWinCommon\sihost.exe"
                                                                                                  31⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1796
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat"
                                                                                                    32⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4624
                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      33⤵
                                                                                                        PID:4680
                                                                                                      • C:\mshyperWinCommon\sihost.exe
                                                                                                        "C:\mshyperWinCommon\sihost.exe"
                                                                                                        33⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2068
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"
                                                                                                          34⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2848
                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                            35⤵
                                                                                                              PID:5236
                                                                                                            • C:\mshyperWinCommon\sihost.exe
                                                                                                              "C:\mshyperWinCommon\sihost.exe"
                                                                                                              35⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2804
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"
                                                                                                                36⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4652
                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                  37⤵
                                                                                                                    PID:5972
                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                    37⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4028
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
                                                                                                                      38⤵
                                                                                                                        PID:5788
                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                          39⤵
                                                                                                                            PID:4464
                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                            39⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2988
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
                                                                                                                              40⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4660
                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                41⤵
                                                                                                                                  PID:1144
                                                                                                                                • C:\mshyperWinCommon\sihost.exe
                                                                                                                                  "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                  41⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4088
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"
                                                                                                                                    42⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:3164
                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                      43⤵
                                                                                                                                        PID:2688
                                                                                                                                      • C:\mshyperWinCommon\sihost.exe
                                                                                                                                        "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                        43⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:4792
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat"
                                                                                                                                          44⤵
                                                                                                                                            PID:3404
                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                              45⤵
                                                                                                                                                PID:3928
                                                                                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                45⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:5912
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat"
                                                                                                                                                  46⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5272
                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                    47⤵
                                                                                                                                                      PID:5412
                                                                                                                                                    • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                      "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                      47⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:5400
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3a8tNGcxSj.bat"
                                                                                                                                                        48⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5020
                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                          49⤵
                                                                                                                                                            PID:5236
                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                            49⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:1424
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
                                                                                                                                                              50⤵
                                                                                                                                                                PID:4544
                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                  51⤵
                                                                                                                                                                    PID:5648
                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                    51⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:1936
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat"
                                                                                                                                                                      52⤵
                                                                                                                                                                        PID:5512
                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                          53⤵
                                                                                                                                                                            PID:4004
                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                            53⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:1300
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat"
                                                                                                                                                                              54⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3664
                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                55⤵
                                                                                                                                                                                  PID:5116
                                                                                                                                                                                • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                  "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                  55⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:4636
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
                                                                                                                                                                                    56⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:4964
                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                      57⤵
                                                                                                                                                                                        PID:5768
                                                                                                                                                                                      • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                        "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                        57⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:6036
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"
                                                                                                                                                                                          58⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:4844
                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                            59⤵
                                                                                                                                                                                              PID:4152
                                                                                                                                                                                            • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                              "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                              59⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              PID:3748
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
                                                                                                                                                                                                60⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat"
                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                        • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                          "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:3928
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"
                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3424
                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MTMDnLe0ZL.bat"
                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                    PID:1792
                                                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                        PID:3372
                                                                                                                                                                                                                      • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                        "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        PID:1232
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0x9T38u1li.bat"
                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                            • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                              "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat"
                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat"
                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                            PID:2560
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat"
                                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                                PID:5052
                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    PID:3052
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat"
                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            PID:3624
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DC0SKfNvdG.bat"
                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat"
                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6068
                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                        • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                          "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:3720
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AvSbArq942.bat"
                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:920
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                    • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                      "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat"
                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1856
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            PID:3788
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                                                                                • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                  "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v65NgynF79.bat"
                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                        PID:2456
                                                                                                                                                                                                                                                                                                      • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                        "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                        PID:3204
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                PID:5972
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat"
                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                      PID:2960
                                                                                                                                                                                                                                                                                                                    • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                      "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat"
                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                            PID:2992
                                                                                                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat"
                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat"
                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                        PID:5736
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                            PID:5212
                                                                                                                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat"
                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                    PID:944
                                                                                                                                                                                                                                                                                                                                                  • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat"
                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5892
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                          • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                            PID:2128
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat"
                                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5716
                                                                                                                                                                                                                                                                                                                                                                • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat"
                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:8
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                                                                                                                                                                                        • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"
                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2752
                                                                                                                                                                                                                                                                                                                                                                              • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                                                                    • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5712
                                                                                                                                                        • C:\Windows\system32\sihost.exe
                                                                                                                                                          sihost.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          PID:1048
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                            2⤵
                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4208
                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                          1⤵
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4752
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2896
                                                                                                                                                        • C:\mshyperWinCommon\sihost.exe
                                                                                                                                                          "C:\mshyperWinCommon\sihost.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3812
                                                                                                                                                          • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2164
                                                                                                                                                            • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                              "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:1116
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:1656
                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4948
                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    PID:3000
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4120
                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1612
                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:3128
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5416
                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:5820
                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:5212
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7kLsQlNPpi.bat"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:5744
                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:5032
                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                          9⤵
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:4276
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
                                                                                                                                                                                            10⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4124
                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:4012
                                                                                                                                                                                              • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat"
                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                      • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                        "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat"
                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                            • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                              "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat"
                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                      • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                        "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:3492
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat"
                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                              • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:788
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:828
                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                      PID:6008
                                                                                                                                                                                                                                    • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                      "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"
                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                                                            • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                              "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              PID:3464
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat"
                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat"
                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                              PID:2080
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:2216
                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat"
                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                              PID:3728
                                                                                                                                                                                                                                                                            • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                              "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YwiSfj46e4.bat"
                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                    PID:2476
                                                                                                                                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat"
                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                        PID:4008
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                            PID:3380
                                                                                                                                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat"
                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat"
                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                                                                                            PID:3920
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"
                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                                                  PID:1896
                                                                                                                                                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat"
                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DC0SKfNvdG.bat"
                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                              • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                PID:3216
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                                                                                      PID:2344
                                                                                                                                                                                                                                                                                                                                    • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"
                                                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                            PID:2480
                                                                                                                                                                                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat"
                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2608
                                                                                                                                                                                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat"
                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6128
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xgactKMGCU.bat"
                                                                                                                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:3800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1312
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4260
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat"
                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nokcDIWAC5.bat"
                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:4508
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4116
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4332
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat"
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat"
                                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows.old\fontdrvhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows.old\fontdrvhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                          • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:1028
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                  • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                                                            • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat"
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                    • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat"
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:1444
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                                                                                                            • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                PID:3428
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat"
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat"
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                              PID:4592
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                PID:796
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat"
                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      PID:2224
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat"
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat"
                                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                    PID:832
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                            PID:1256
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MUFyTxLHSg.bat"
                                                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1312
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1824
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat"
                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\uk-UA\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\uk-UA\OfficeClickToRun.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3460
                                                                                                                                                                                                                                                                                                                                                • C:\mshyperWinCommon\Registry.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\mshyperWinCommon\Registry.exe"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat"
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1244
                                                                                                                                                                                                                                                                                                                                                      • C:\mshyperWinCommon\Registry.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\mshyperWinCommon\Registry.exe"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                                                                                • C:\mshyperWinCommon\Registry.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\mshyperWinCommon\Registry.exe"
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\w32tm.exe
                                                                                                                                                                                                                                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2336

                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                      • Size 603B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                      • Size 595B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      0VN2lTwXPf.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2cf5c1403405e3b5065b341d5809edf3112c649706d189d4c3c463c74d7e77de
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      0x9T38u1li.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\0x9T38u1li.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f6adfaaf4c702f8b579c69a65d2888a5c19f5742df63e0881689776781cd8ce3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      19YD2Vui68.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 79ba398dacc83cb92e4cd782f0d11a433104197d99ab7f33989dcf37649e104e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      3a8tNGcxSj.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3a8tNGcxSj.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5bd967e6346491d76a791d1b3c8d77924cee191312670485d88531b3eec4bb0d
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      3jGxsc69Nm.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bc1ae366249e5f9a0ec692e205bd92577192bdb20b42c4aca4287ce6b9269024
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      3npectBbsF.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 51376649b1c3819ad8a2318c1b49a7475eccb130a41f9495da58a6a3829f8fd6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      4WSxKcEorb.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 665dd37a1d02a46182f62e01df4d14d65cb07e09a30c3914e4770d724ac51e30
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      4rzlnKig63.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2015f785dec1a97bba1a91e34ff4b05d1edbb236f10591b9667e8db38e7502df
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      53OVnhiNRT.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 922533cc2fc6bc982e7426f5e51bb825023c04939c8947fdd8e09109fa08e92a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      5bc4V3lt5Q.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 849a28a60ff8aac14493c7c69480754cdeb314e1331ab4183bcae6c1abfd4a11
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      6VAw4LgrmW.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\6VAw4LgrmW.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3ca320b91284beadc16aa92a42b5f73f6414cd46cc782e020c8f4bc5e3863676
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      6Zqs8041Oe.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 21c119c47a0ac5da983ae2e98797ce920656e7e9e242f27c4a0e9c7321b1d22a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      7kLsQlNPpi.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7kLsQlNPpi.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 80d99727ab48a53500694b2289d17e1b05751e1b79c4cb73290d9704b5807bf7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      80JI9OTYea.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9504c32ee658814037a3f07696e6ae30d76de8acd3ae3932b90b3256b6a2e5b0
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      826UXRAQMN.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d483f7ef602e514884bdc4355d66f3fbf3e72d7ebdd2a2a1bb58bbae1a328f3b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      8Lq6d7xQt2.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 197B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e9a3df2ba34b4d056eaa555c2d0f18ed8f46eee6124d955474b957e86c2a4595
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      8Lq6d7xQt2.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 11f862d13f47b5d7ee5081ce8a9cb7eb9abe63222c6cd37e9d9a320d9b1b6a4e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      9BpIS9nw5f.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f3e12dbd8a6c1e44dd89d0b1a5e5bbbf52d922d6bed90ef1dc4c0c30899e6e35
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ANE2RWndQ4.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 86b575bb06ba8d224ff38e26f802f05963ad26ac053feebdc300696cd2cfc85e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AWL6wsGpK7.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 74aaa3ca0bdc6d1634f8815afb334c6c02ebc4787c3caf5f7be30e7a81221956
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AvSbArq942.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AvSbArq942.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 78372ef87fe73de167e94649338a657b4a930136c4f2d2cf9c6b182503a170d6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BAWHCtE00Z.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6c2711fc9d7117a8cce17eb5d777e8b8b1bcba447d0dc1590e5208ab6aae7f78
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BGyPdaK1JU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2d690584cf34c30d203e468e6faaa0f2c4076148ca6bf9a19dd9e1d1d0d2ede4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BcPyovVCSH.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 da41b3852ad746373c9d4c5ef9bae7f57fd86c403b18d78e30875900af926033
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BmKXfVMxAz.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ffa1378ebaeb2da02bc1b403b3f561af8ccc3d2e34b4788e670b55ffc7adb242
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CL2HVdYORd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c267669815e919a9de5cc78b9b76963db9456947fc12e56d573efd4c57c44ebc
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CPbxFudqw6.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c1b7db1f21a443dffc7e484465788901dad6553e2a7d5cf8e13a6b63ef8260f5
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CSN9cxKiet.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6e6f51efab44f335afaf6e6d27fbd3623391bbdce747c99c0a49ff141958be00
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      DC0SKfNvdG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\DC0SKfNvdG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e9448e78874e75c6994b5d3968771e81ba30f4c50658e92fd5516dfc19c1da8c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      DC0SKfNvdG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\DC0SKfNvdG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4832a32fbc0b704130a819ca7f278939d4ad1619e39ad6c5b3e38d872d0d3a0b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ELjGFNzRMY.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fb2d6887e293d6ddc976aa9f3ae925747eb84305e1099c44f05c3401a485d1ae
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      FFGwGvdk9Y.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FFGwGvdk9Y.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ba402efd38ddfc899bf4019e27d3bc9099bf9fe5b0b1b47d4495fd188891bcb4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      FaowIOOII5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b81f0f38b4e201db69689788532159898ed9a167ce01e5349155cc4402ba6b6f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      GzuRWOxc20.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 350836511ab15324fa16ce556c3cb7f8cc7703e913aa1ef0240d9686656719e0
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      HKL0gj8mBn.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cd3b35879fb5988ad3d5e167b9671009c004de9dc6d5e75e3864bebde07393f7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      JJ2zQTaq6h.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 16e1f98fdce491c407168cb83d6d2c4ac02dfe75eb1274b1384e4b52ff4ccc05
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Kz6bOuYaab.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8d5291f61072d7bb2640a94bcc601e99116b8071ae7d8ba84d24f4545e3bd3a1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      LZh5ueQJla.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f9ed65d6ec6d611ccd16f9149a4e62b310925ba163c3eac22030a03b09586a83
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MTMDnLe0ZL.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MTMDnLe0ZL.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 848012a1d7a72b67c46f8b7394ea7b92b6b794f535feec603afae05688b383aa
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MUFyTxLHSg.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MUFyTxLHSg.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8168397cf22bd854242d64510a08b66f03cc531772bfe901aba994ffe501644b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MsMShxucCb.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 846a7edd48be1750e6986aa77ab3bb416322349909223bb2e451cf09a0845efd
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MsSi1KDKJG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ba02defcb1f3d74b74bdebf5ce2be995782a9b24e0bb1e065f6cf97f298d4c19
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      NADK710Kqv.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0da9f2ce94971a9fd1e05676fc03727768a509fc4f9fb4cb72249419a108dec1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Nl6pt1R060.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ec497467aef78c056b1803efd86448c61f335ef1d154328bbfd711d982cf53c7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Nl6pt1R060.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3f3e95ce60f9f7713d34577cbbd253bffcb188289767233c5481b3342fe2a751
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      OVj8bjUD5N.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7a3e3513c58c709adfc257a2551e134568256660401950829c18b566724a1959
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      OZJpL0Zeaq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4da8e66960897a7a1e9f943fc7407c4ed66180cc3e0eff280048f1837419cfb6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      OvjOVLkpjd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 87f8d95c1e4d977eb9290c6632a009e3f7bcaeea49020faea0c55167ea9063c7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      PCaGvPqXNx.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3e1f056528b38e5359eb92f6abe6f75453745f57131cd99f295b76294071abee
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      PJw82jcrZC.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a53f93d329f3dcb5e287ed6e8252aaee322e84569b78ef58aa1aa7e6e6dcea59
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ST975DOJvB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3bf919c86e7a99534781bd7f0837ced804c48e42882b14d883d55ae303d83c2b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      SU2rmp5bpW.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8ad3cd4b1262aaf2158c411a5308f82269930288cfe8d0fd2369a5b99e897d9f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      SsFcJDxdf6.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 eab0966ed8bf660d5a4c555fd9e3474c6e37537c1b426cd118bb53ad8b602b89
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      UMVEid32eq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2684d848c80da8ec7cdd24b015d65363bd4d1c823e7eec4e84e000fde99c222e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      UPAAmIRCFx.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a3049ceec72251ae3dc478c2b3483e5d773f7ca7cb9ca9303db911cbe542579c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      USq6qxpMr5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8f23772293e685b9a63f03c9f2035138591e616ad3116f6ab6c96e44eda9faad
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Urxb3wPgb0.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4d81da889fe847d5b7cce8450cd3b9d02b1633938e20ab20b488c0ea0b69a2e2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      VDNADHaqjn.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 383e11974e6b3063b8b950144c9821620a829f157c950ad420021ce776cf8ae9
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WPmuDeaX4D.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 378d3a480bb1615cc95c7ccd0fb1d5685a7963529d026456d8f98b52c7c56c00
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      XBBOHPKclM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5d4ad5e11d805504c4c99baaf3be698e3c70428862921583c0659dea68e6da83
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      XC59y11ueh.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 13e370bbfdef78a99e7d134bf52250f3d76256564aae5d8a18e661677a961b50
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YKuCD7w8Ue.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bd613cf233a543e5b15e0d0bc6c1c5cfd1782a4b7574a6a0c9568550fc460f9a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YwiSfj46e4.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YwiSfj46e4.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 212b130e89eaae6672c284e178ecddacd8950aec249f573e4093060db69ce1fb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ZES4mQr7Bk.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1db80753aeb8bded777fb31fd0fde2755896e937e615f2da97b5dfb5505f0d80
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cRRFCwJQFV.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d1f204def82161990af1a1fc1d5a32ae465aff7a8a708c8f4b577303f3b9a22e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cxnNEsMM51.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4a68d10dec0ec0e27f88903b38832a1e832945c4e42f786d1a9276f0908bae2a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      dnlY2uCtHd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8182f5a4ca50fc667f11d0a3dd7359e4763cd98a798b223cf7b44627426ce32d
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eKh6VzgSrU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5e0dbc98d1e8db1f9b2fc497eb41829ed8f48099672f6e4c624df84dfa99965b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eON2Ze4cSc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 aea6b60b0bca80f13ad4454a63eb8c36225644a0acadab528aed23ae4563c5bb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      esvfELjyVS.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 72f43c400c43772afb9151715782da355504134ddd79b6b4b9032a82a5c819d0
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ezHXLeVHih.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6ff37ff99986ac8e00ac7539e6d9403329ac153120774205a26ee4cfe2a773fe
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      h6hK16ZrMt.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3e83944005a60826c216c252124bc088ca8076658c78f8994dec04432aaaca6c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      hANH4lx1y1.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b14d8f9af2cfeb070d7bbe42da4440ff00bc438cfe1387385d092863179ad414
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      iYTmIkWLiw.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4fef39dd3bfd4f297b4addb9345bf4fbae5f9ff8b809094736372cf5b1e88541
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      j5PKlq1uIo.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e4db024d757f5292889ae25a2a217562b2d2e38a487405773c411a772b80561f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      jddtUB3Qwl.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1dd5095cefff84bc034a5ad4eb17140474949e23b15ad37a95e228a375353f88
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      jhJpXqSaXt.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 57ffcf645effd9d8c94fc25f328154c1bd8fb5c54c6a261bd17de380a5b787a7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kKaF7FiTK0.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5b72464da4b16986bf97dd6f2134fe040541442d8a578371445cb52216e0b23e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      l7tVtcAquU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ad6b82516e0f2f44ca20d66bb6f1238d114140ed26c387321df3b1d05382992
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      l8nFZEr7oq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7c57b3e369c4096bdc6dab0c6a3c6d90410711b49a00b79c273f365747ffdcd8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mJIFszAWFu.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6dc426e540f3eca741bec4ba9242ea528264cd690b6876def5da36d169212b9f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mWzz7cjAeP.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 281d8ee3193a9e366c0c295fc364584540527f3b2681341d03553c09488adf89
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mxrgiezM67.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 226B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e8a817cd3ba1e171b81a2ec7ae4c251de49d338a656cc17006e0b53fe307b3fd
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      nGW3UwTeX7.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0e0175e72b3e9e4d84184c1b5f0107e6044c110cbe547ba19287b9629ad84054
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      nlAvT1Qihc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c59137cdc1eb9f634ff23640dbfd8a8271c6d8d8bf3ca27544a7b6f707356d62
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      nokcDIWAC5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nokcDIWAC5.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 779dfb2581911b4326e0d9eef169d3e10930a339868cc53f39f83d713b78cfe0
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      oxTQ808hvM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 42334e344cff479c86a8018e59affdfc1df6a260c904c3b8bc723cb20c951829
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      pI0EcicZAo.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9e0c54d65a74a2ad7f0984f983081a31a2ea2562cff8c384ebdf3f1f82612588
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      s1KW4B7p45.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a724b1f7dd80973822a7e8502e89e2e850400d06ade28e16b80801f5460061d5
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      svsOdT1nlB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 197B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cd85ad1cbc38e5c552488e69c9427a754fac786f50b8dd4e72a6e3d500c2640c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      svsOdT1nlB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 dd2d2b0f59674d05e0cbbb290d0298987b9d337e6dc50f8e478e72d2d2e42384
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uVUt9EuWwA.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 eae896146d124fd1e735457772b5e49a29eff628680c0c9c9731cbc65ac93aae
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uZApDsIgYI.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8640482bf0a99c9e1437d83ce7e8f8a35b5582a5aa39a22ecde2fd6273719204
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      v65NgynF79.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\v65NgynF79.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 97ce15cf6569ddf72db161a448d631272c09db4037dddf9b374d020ba59f42de
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      vhtd8auDHa.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7f41cb4720d930e4696ffb442f5048a10f1c9d4c50462538075bd115d418d3fd
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      x5nMQhEI33.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 03288a8132472ee63f535ab004da37eb4780e41910ffe500919e11c40df16712
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      xEoBbgPmrR.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0a6602f593da83d4ca0d009a980ccf8c5dc0da4de64a93829d07085ed6ba129a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      xgactKMGCU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xgactKMGCU.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4230ff35cd8382527d171766efc2cebd865494485d5c7da5ff7b78d3c1900a5a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      xghrCifyI9.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d606706300d6fc41ea6a8c445c7616f21d46b3baedd81c0a53579ee5265f1b89
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      xkGYwzkQoc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 74865c367464abd5274df4bcb98f7fdaff56d86744a40956c5a746c878f425be
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      xkGYwzkQoc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0f14dceea03e45ce94e6c303941ec531355ae8c1064d28f7b2388c8a7e52d29a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      yJyIm7wr5G.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4e140750a8c7d5c481519f170507db5c68c6f2646366d384368807809fe79fd2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ys6bB5gfdY.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 195B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f63cfa818e0c91e6bee6d808ef430eb4af159d1f255b7887aac1c09d3ee49e37
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BlockWebdriver.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\mshyperWinCommon\BlockWebdriver.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 827KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 98c6e637a0523864c98b4f99bc34a47eac4f8d42d13399eb333a1168846deaf6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ZghAVpTvHKXvaHZHZwjLT4B.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\mshyperWinCommon\ZghAVpTvHKXvaHZHZwjLT4B.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1f07328192bc70d87c69708c351c4af015d96e424c5c60b5c4c108cb0383be5c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sq3hmjfP.vbe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\mshyperWinCommon\sq3hmjfP.vbe
                                                                                                                                                                                                                                                                                                                                                                      • Size 217B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fdadc75e748d6d4dbf0a5e65294915e39cc0b118b19794360fdbdae53a69d562
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      memory/908-539-0x000000001CAC0000-0x000000001CC01000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1232-490-0x000000001E440000-0x000000001E581000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1300-440-0x000000001BE60000-0x000000001BF8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1424-424-0x000000001BD20000-0x000000001BE4F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1648-644-0x000000001E000000-0x000000001E1CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1936-433-0x000000001BCD0000-0x000000001BDFF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2128-623-0x000000001D780000-0x000000001D94A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2380-504-0x000000001CC50000-0x000000001CD91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2560-511-0x000000001D750000-0x000000001D891000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3052-518-0x000000001D840000-0x000000001D981000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3108-532-0x000000001CDF0000-0x000000001CF31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3204-574-0x000000001E550000-0x000000001E71A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3212-705-0x000000001BEC0000-0x000000001C001000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3484-616-0x000000001E000000-0x000000001E1CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3532-609-0x000000001E100000-0x000000001E2CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3624-525-0x000000001E400000-0x000000001E541000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3720-546-0x000000001D840000-0x000000001D981000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3748-461-0x000000001BE60000-0x000000001BF8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3788-560-0x000000001E640000-0x000000001E80A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3928-475-0x000000001C750000-0x000000001C87F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4068-468-0x000000001BD40000-0x000000001BE6F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4152-602-0x000000001E520000-0x000000001E6EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4172-497-0x000000001CDE0000-0x000000001CF21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4444-483-0x000000001BD20000-0x000000001BE4F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4576-14-0x0000000000100000-0x00000000001D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4636-447-0x000000001BE20000-0x000000001BF4F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4696-567-0x000000001CA10000-0x000000001CBDA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4708-553-0x000000001CC50000-0x000000001CD91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4752-260-0x000001EB81B70000-0x000001EB81B90000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4752-242-0x000001EB81DE0000-0x000001EB81EE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4752-276-0x000001EB84100000-0x000001EB84120000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4752-230-0x000001EB801E0000-0x000001EB802E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4752-241-0x000001EB81910000-0x000001EB81930000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4804-637-0x000000001CAE0000-0x000000001CCAA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4868-588-0x000000001F000000-0x000000001F1CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5028-595-0x000000001E400000-0x000000001E5CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5400-415-0x000000001D340000-0x000000001D46F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5436-630-0x000000001E100000-0x000000001E2CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5912-406-0x000000001BE60000-0x000000001BF8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5972-581-0x000000001E000000-0x000000001E1CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6036-454-0x000000001C750000-0x000000001C87F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download