Analysis
-
max time kernel
1195s -
max time network
905s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
29-06-2024 22:47
General
-
Target
sp00fer.exe
-
Size
3.1MB
-
MD5
a121d9d691a400786000dee14a808ab1
-
SHA1
14ab065be3cfe0a7aa7808cb8891f7c75affc395
-
SHA256
7849231d077a00fd9129c2c6cecbb3287afc5656b8dfd263fdf57e2432d4f335
-
SHA512
e0a162b3d00ef69b96bd4a43f9a0c3297005e8a8db84233010d420bf87ff337ed4139b4cc27594fdd194416a03fe8a7be90b03a8f10e34b72f70d399d6917929
-
SSDEEP
49152:zvulL26AaNeWgPhlmVqvMQ7XSKLCO1JRLoGdFTHHB72eh2NT:zveL26AaNeWgPhlmVqkQ7XSKLCE
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
pringelsy-51954.portmap.host:51954
Mutex
6dc28d35-3024-44a7-a559-f9991015fa39
Attributes
-
encryption_key
3107DF2D44BB6914C55BEA57D100135AB0F278DF
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
799
-
startup_key
Quasar Client Startup
-
subdirectory
Common Files
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 62 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sp00fer.exe"C:\Users\Admin\AppData\Local\Temp\sp00fer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QgRYu8XkixsI.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DCdLUOfPtAWT.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f7⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JES2OJ5AlNvR.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NrgzEmf3vT8D.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f11⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NPNcEMLGIDOV.bat" "11⤵
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VSaK6BsdO5HS.bat" "13⤵
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f15⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\q3ssle8pWLKP.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"16⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BxF8TPj72Bvj.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"18⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Im4pvohi1Crg.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f21⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1tjLsHvlbGBD.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TmOTIb3kldzL.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QIjYzwQ42Z9F.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f27⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FJWWaKGavioN.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f29⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wd4FUKrPJxew.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f31⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\x6g5YWHPYIIi.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f33⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fjqFj0HmoEim.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f35⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cfNa7oQkuiZg.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"36⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f37⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PEYdhoaeOXf8.bat" "37⤵
-
C:\Windows\system32\chcp.comchcp 6500138⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost38⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f39⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6ioLPO1Zr2Kq.bat" "39⤵
-
C:\Windows\system32\chcp.comchcp 6500140⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f41⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\nF7cMDcwOZnu.bat" "41⤵
-
C:\Windows\system32\chcp.comchcp 6500142⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"42⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f43⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1QeM9VAuG6w4.bat" "43⤵
-
C:\Windows\system32\chcp.comchcp 6500144⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost44⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"44⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f45⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\O0nHL2rN8lsh.bat" "45⤵
-
C:\Windows\system32\chcp.comchcp 6500146⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost46⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f47⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WmsjofwZJhFH.bat" "47⤵
-
C:\Windows\system32\chcp.comchcp 6500148⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"48⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f49⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GYytgcbQkxep.bat" "49⤵
-
C:\Windows\system32\chcp.comchcp 6500150⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost50⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f51⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\9sBlTwlaEOsz.bat" "51⤵
-
C:\Windows\system32\chcp.comchcp 6500152⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost52⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f53⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zdLnro68UX0f.bat" "53⤵
-
C:\Windows\system32\chcp.comchcp 6500154⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f55⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RpkR7A2ov1Kw.bat" "55⤵
-
C:\Windows\system32\chcp.comchcp 6500156⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost56⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f57⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\feGSUUNpl4vL.bat" "57⤵
-
C:\Windows\system32\chcp.comchcp 6500158⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost58⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"58⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f59⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ug1nigOUrpRu.bat" "59⤵
-
C:\Windows\system32\chcp.comchcp 6500160⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"60⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f61⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GLq3QkdvJzuh.bat" "61⤵
-
C:\Windows\system32\chcp.comchcp 6500162⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost62⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f63⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gj09BPDQZsEB.bat" "63⤵
-
C:\Windows\system32\chcp.comchcp 6500164⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost64⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f65⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\56XK20SDirD8.bat" "65⤵
-
C:\Windows\system32\chcp.comchcp 6500166⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"66⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f67⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CBNebGtFyYjR.bat" "67⤵
-
C:\Windows\system32\chcp.comchcp 6500168⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost68⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"68⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f69⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\exCh1nbx8cU5.bat" "69⤵
-
C:\Windows\system32\chcp.comchcp 6500170⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost70⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"70⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f71⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JgkUUkacFyOD.bat" "71⤵
-
C:\Windows\system32\chcp.comchcp 6500172⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost72⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"72⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f73⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mk7S78LKNuuc.bat" "73⤵
-
C:\Windows\system32\chcp.comchcp 6500174⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"74⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f75⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\x6N6sGf86s9W.bat" "75⤵
-
C:\Windows\system32\chcp.comchcp 6500176⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost76⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"76⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f77⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\uWnXaMnQRdkW.bat" "77⤵
-
C:\Windows\system32\chcp.comchcp 6500178⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost78⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"78⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f79⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8u5vKSAzCgif.bat" "79⤵
-
C:\Windows\system32\chcp.comchcp 6500180⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost80⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"80⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f81⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KWZdMpV7hP4z.bat" "81⤵
-
C:\Windows\system32\chcp.comchcp 6500182⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost82⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"82⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f83⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\06gbc4VOjpZj.bat" "83⤵
-
C:\Windows\system32\chcp.comchcp 6500184⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost84⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"84⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f85⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Kl4Ca7bgrea4.bat" "85⤵
-
C:\Windows\system32\chcp.comchcp 6500186⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost86⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"86⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f87⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1WrdTlk4MdFr.bat" "87⤵
-
C:\Windows\system32\chcp.comchcp 6500188⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost88⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"88⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f89⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QHvOYB3hvqDa.bat" "89⤵
-
C:\Windows\system32\chcp.comchcp 6500190⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost90⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"90⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f91⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FY04I38RorxR.bat" "91⤵
-
C:\Windows\system32\chcp.comchcp 6500192⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost92⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"92⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f93⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SYWsIhTBCDh7.bat" "93⤵
-
C:\Windows\system32\chcp.comchcp 6500194⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost94⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"94⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f95⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hv58tvBzLycd.bat" "95⤵
-
C:\Windows\system32\chcp.comchcp 6500196⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost96⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"96⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f97⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BjlBbRNqoOoe.bat" "97⤵
-
C:\Windows\system32\chcp.comchcp 6500198⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost98⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"98⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f99⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ZPFz8AM6rFkd.bat" "99⤵
-
C:\Windows\system32\chcp.comchcp 65001100⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost100⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"100⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f101⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\xhI9dpLDNewe.bat" "101⤵
-
C:\Windows\system32\chcp.comchcp 65001102⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost102⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"102⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f103⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vSKzuMNtlea0.bat" "103⤵
-
C:\Windows\system32\chcp.comchcp 65001104⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost104⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"104⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f105⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FeG760l7rphU.bat" "105⤵
-
C:\Windows\system32\chcp.comchcp 65001106⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost106⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"106⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f107⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VLN1xVbDBPDG.bat" "107⤵
-
C:\Windows\system32\chcp.comchcp 65001108⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost108⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"108⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f109⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4e1CeYBhUV4G.bat" "109⤵
-
C:\Windows\system32\chcp.comchcp 65001110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost110⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"110⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f111⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\899o92IVorj7.bat" "111⤵
-
C:\Windows\system32\chcp.comchcp 65001112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost112⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"112⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f113⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\k2uDCZevVKC5.bat" "113⤵
-
C:\Windows\system32\chcp.comchcp 65001114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost114⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"114⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f115⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LKWRiNCQAq4Y.bat" "115⤵
-
C:\Windows\system32\chcp.comchcp 65001116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost116⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"116⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f117⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6QaiGLBCuMtZ.bat" "117⤵
-
C:\Windows\system32\chcp.comchcp 65001118⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost118⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"118⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f119⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1VsU7nt9sqf4.bat" "119⤵
-
C:\Windows\system32\chcp.comchcp 65001120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost120⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"120⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f121⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gmJtRpRcb1jb.bat" "121⤵
-
C:\Windows\system32\chcp.comchcp 65001122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost122⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"122⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f123⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\72a4u6s0c4jp.bat" "123⤵
-
C:\Windows\system32\chcp.comchcp 65001124⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost124⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"124⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f125⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qz7PLUacFAdO.bat" "125⤵
-
C:\Windows\system32\chcp.comchcp 65001126⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost126⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"126⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f127⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JZa78WXT7M7P.bat" "127⤵
-
C:\Windows\system32\chcp.comchcp 65001128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost128⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"128⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f129⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sgIP8R08p00A.bat" "129⤵
-
C:\Windows\system32\chcp.comchcp 65001130⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost130⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"130⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f131⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\J20mkx27t1ry.bat" "131⤵
-
C:\Windows\system32\chcp.comchcp 65001132⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost132⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"132⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f133⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Pa3cGyHHqPcc.bat" "133⤵
-
C:\Windows\system32\chcp.comchcp 65001134⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost134⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"134⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f135⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\suTh7XtuAnvk.bat" "135⤵
-
C:\Windows\system32\chcp.comchcp 65001136⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost136⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"136⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f137⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\r8CsJGu6RYjU.bat" "137⤵
-
C:\Windows\system32\chcp.comchcp 65001138⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost138⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"138⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f139⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\I2KlgRtip72Z.bat" "139⤵
-
C:\Windows\system32\chcp.comchcp 65001140⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost140⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"140⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f141⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HuNcMOj5KXtQ.bat" "141⤵
-
C:\Windows\system32\chcp.comchcp 65001142⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost142⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"142⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f143⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FNyTOF0EjvpI.bat" "143⤵
-
C:\Windows\system32\chcp.comchcp 65001144⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost144⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"144⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f145⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QxiX5IS7ntvV.bat" "145⤵
-
C:\Windows\system32\chcp.comchcp 65001146⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost146⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"146⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f147⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MHz6Xuy6l7Pn.bat" "147⤵
-
C:\Windows\system32\chcp.comchcp 65001148⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost148⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"148⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f149⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\d8EoKm9bj911.bat" "149⤵
-
C:\Windows\system32\chcp.comchcp 65001150⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost150⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"150⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f151⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4Nk9OxTAQvAf.bat" "151⤵
-
C:\Windows\system32\chcp.comchcp 65001152⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost152⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"152⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f153⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PR8SFirmmaqg.bat" "153⤵
-
C:\Windows\system32\chcp.comchcp 65001154⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost154⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"154⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f155⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yvwYHpHnJAmM.bat" "155⤵
-
C:\Windows\system32\chcp.comchcp 65001156⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost156⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"156⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f157⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\z3VODNkDwK3T.bat" "157⤵
-
C:\Windows\system32\chcp.comchcp 65001158⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost158⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"158⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f159⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3KBJ46ilhneH.bat" "159⤵
-
C:\Windows\system32\chcp.comchcp 65001160⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost160⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"160⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f161⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4ELZfM44Pkrg.bat" "161⤵
-
C:\Windows\system32\chcp.comchcp 65001162⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost162⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"162⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f163⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\98l3zKYIT7Ce.bat" "163⤵
-
C:\Windows\system32\chcp.comchcp 65001164⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost164⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"164⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f165⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Q1dNfiNfddH1.bat" "165⤵
-
C:\Windows\system32\chcp.comchcp 65001166⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost166⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"166⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f167⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CxeR9AWNtxJR.bat" "167⤵
-
C:\Windows\system32\chcp.comchcp 65001168⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost168⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"168⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f169⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YZh9nAN7xbYE.bat" "169⤵
-
C:\Windows\system32\chcp.comchcp 65001170⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost170⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"170⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f171⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KyvQ4OX44182.bat" "171⤵
-
C:\Windows\system32\chcp.comchcp 65001172⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost172⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"172⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f173⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\9jp43bBjsDWM.bat" "173⤵
-
C:\Windows\system32\chcp.comchcp 65001174⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost174⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"174⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f175⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LAyxA36bF60A.bat" "175⤵
-
C:\Windows\system32\chcp.comchcp 65001176⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost176⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"176⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f177⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mFqg6DYNq88m.bat" "177⤵
-
C:\Windows\system32\chcp.comchcp 65001178⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost178⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"178⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f179⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dwgUi0AChpoq.bat" "179⤵
-
C:\Windows\system32\chcp.comchcp 65001180⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost180⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"180⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f181⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GOl6cyhctgJU.bat" "181⤵
-
C:\Windows\system32\chcp.comchcp 65001182⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost182⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"182⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f183⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jg83utsisLlW.bat" "183⤵
-
C:\Windows\system32\chcp.comchcp 65001184⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost184⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"184⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f185⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PI9wIfsMuIfN.bat" "185⤵
-
C:\Windows\system32\chcp.comchcp 65001186⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost186⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"186⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f187⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WXfWyKpNUqdp.bat" "187⤵
-
C:\Windows\system32\chcp.comchcp 65001188⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost188⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"188⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f189⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TmteVaG1FIRz.bat" "189⤵
-
C:\Windows\system32\chcp.comchcp 65001190⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost190⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"190⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f191⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dnKMEh4SZn4u.bat" "191⤵
-
C:\Windows\system32\chcp.comchcp 65001192⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost192⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"192⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f193⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qe3P26sZImqU.bat" "193⤵
-
C:\Windows\system32\chcp.comchcp 65001194⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost194⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"194⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f195⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\52nadDRuniio.bat" "195⤵
-
C:\Windows\system32\chcp.comchcp 65001196⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost196⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"196⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f197⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gvBEAuREwxmS.bat" "197⤵
-
C:\Windows\system32\chcp.comchcp 65001198⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost198⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"198⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f199⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NcPz9GhwmM4t.bat" "199⤵
-
C:\Windows\system32\chcp.comchcp 65001200⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost200⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"200⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f201⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rDCUao8J4Nhw.bat" "201⤵
-
C:\Windows\system32\chcp.comchcp 65001202⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost202⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"202⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f203⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IQDa5zikl9Fu.bat" "203⤵
-
C:\Windows\system32\chcp.comchcp 65001204⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost204⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"204⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f205⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8nfvfm4FYZ1X.bat" "205⤵
-
C:\Windows\system32\chcp.comchcp 65001206⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost206⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"206⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f207⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\McITpRt0OaOq.bat" "207⤵
-
C:\Windows\system32\chcp.comchcp 65001208⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost208⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"208⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f209⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kYuk9GU2cxCZ.bat" "209⤵
-
C:\Windows\system32\chcp.comchcp 65001210⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost210⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"210⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f211⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\uDbmeyngwxLU.bat" "211⤵
-
C:\Windows\system32\chcp.comchcp 65001212⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost212⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"212⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f213⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8oVvV0luTdff.bat" "213⤵
-
C:\Windows\system32\chcp.comchcp 65001214⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost214⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"214⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f215⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YGdpnK5FHtKI.bat" "215⤵
-
C:\Windows\system32\chcp.comchcp 65001216⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost216⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"216⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f217⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Q4zocqnFLh9a.bat" "217⤵
-
C:\Windows\system32\chcp.comchcp 65001218⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost218⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"218⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f219⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Wr7mpSMFkuFa.bat" "219⤵
-
C:\Windows\system32\chcp.comchcp 65001220⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost220⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"220⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f221⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\czPRdpVmyLK8.bat" "221⤵
-
C:\Windows\system32\chcp.comchcp 65001222⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost222⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"222⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f223⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\f4kubUmMgLs0.bat" "223⤵
-
C:\Windows\system32\chcp.comchcp 65001224⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost224⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"224⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f225⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\nQEmsIWfenom.bat" "225⤵
-
C:\Windows\system32\chcp.comchcp 65001226⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost226⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"226⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f227⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\eg6Wl1mdBvvu.bat" "227⤵
-
C:\Windows\system32\chcp.comchcp 65001228⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost228⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"228⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f229⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DbCkH5Jbpwhh.bat" "229⤵
-
C:\Windows\system32\chcp.comchcp 65001230⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost230⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"230⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f231⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\eXmnDnhkHld7.bat" "231⤵
-
C:\Windows\system32\chcp.comchcp 65001232⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost232⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"232⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f233⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HWZg5RyGX5O7.bat" "233⤵
-
C:\Windows\system32\chcp.comchcp 65001234⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost234⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"234⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f235⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Wi0LX0lYvr1G.bat" "235⤵
-
C:\Windows\system32\chcp.comchcp 65001236⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost236⤵
- Runs ping.exe
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"236⤵
- Drops file in Program Files directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f237⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8pfO59ue7cyY.bat" "237⤵
-
C:\Windows\system32\chcp.comchcp 65001238⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost238⤵
-
C:\Program Files\Common Files\Client.exe"C:\Program Files\Common Files\Client.exe"238⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f239⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qLIuMqAfmeDC.bat" "239⤵
-
C:\Windows\system32\chcp.comchcp 65001240⤵