pointed to 5.34.181.13. Using PassiveTotal we found 40.dc.c0ad.ip4.dyn.gsvr-static[.]co. Googling for gsvrstatic[.]co, we found another sample, gpupdate.bat," which runs PowerShell code that extracts a Cobalt Strike