Overview

overview

10

Static

static

10

sp00fer.exe

windows7-x64

10

sp00fer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1193s
  • max time network
    1198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2024 22:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sp00fer.exe

  • Size

    3.1MB

  • MD5

    a121d9d691a400786000dee14a808ab1

  • SHA1

    14ab065be3cfe0a7aa7808cb8891f7c75affc395

  • SHA256

    7849231d077a00fd9129c2c6cecbb3287afc5656b8dfd263fdf57e2432d4f335

  • SHA512

    e0a162b3d00ef69b96bd4a43f9a0c3297005e8a8db84233010d420bf87ff337ed4139b4cc27594fdd194416a03fe8a7be90b03a8f10e34b72f70d399d6917929

  • SSDEEP

    49152:zvulL26AaNeWgPhlmVqvMQ7XSKLCO1JRLoGdFTHHB72eh2NT:zveL26AaNeWgPhlmVqkQ7XSKLCE

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

pringelsy-51954.portmap.host:51954

Mutex

6dc28d35-3024-44a7-a559-f9991015fa39

Attributes
  • encryption_key

    3107DF2D44BB6914C55BEA57D100135AB0F278DF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    799

  • startup_key

    Quasar Client Startup

  • subdirectory

    Common Files

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 56 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 57 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 56 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 58 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\sp00fer.exe
    "C:\Users\Admin\AppData\Local\Temp\sp00fer.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2444
    • C:\Program Files\Common Files\Client.exe
      "C:\Program Files\Common Files\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9milzwDyGjow.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2596
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:688
          • C:\Program Files\Common Files\Client.exe
            "C:\Program Files\Common Files\Client.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3092
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kNmGobdPK4ej.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4004
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:3724
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:448
                • C:\Program Files\Common Files\Client.exe
                  "C:\Program Files\Common Files\Client.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2760
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3168
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AE5Czrl8ZSxU.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4584
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:3740
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:3668
                      • C:\Program Files\Common Files\Client.exe
                        "C:\Program Files\Common Files\Client.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:4372
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3764
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LAwaLImXzJgM.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2668
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:1280
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:2132
                            • C:\Program Files\Common Files\Client.exe
                              "C:\Program Files\Common Files\Client.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:2688
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                11⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:4128
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6kamOhoB7mVe.bat" "
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4520
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:1588
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • Runs ping.exe
                                    PID:3624
                                  • C:\Program Files\Common Files\Client.exe
                                    "C:\Program Files\Common Files\Client.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4524
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                      13⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3280
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\35GueDsOjmBq.bat" "
                                      13⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2924
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        14⤵
                                          PID:3680
                                        • C:\Windows\system32\PING.EXE
                                          ping -n 10 localhost
                                          14⤵
                                          • Runs ping.exe
                                          PID:3084
                                        • C:\Program Files\Common Files\Client.exe
                                          "C:\Program Files\Common Files\Client.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2268
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                            15⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3692
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2dqcK1cdBzLb.bat" "
                                            15⤵
                                              PID:3260
                                              • C:\Windows\system32\chcp.com
                                                chcp 65001
                                                16⤵
                                                  PID:1724
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 10 localhost
                                                  16⤵
                                                  • Runs ping.exe
                                                  PID:3176
                                                • C:\Program Files\Common Files\Client.exe
                                                  "C:\Program Files\Common Files\Client.exe"
                                                  16⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:704
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                    17⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2208
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CjqbtOpWkCeY.bat" "
                                                    17⤵
                                                      PID:2304
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        18⤵
                                                          PID:2584
                                                        • C:\Windows\system32\PING.EXE
                                                          ping -n 10 localhost
                                                          18⤵
                                                          • Runs ping.exe
                                                          PID:1448
                                                        • C:\Program Files\Common Files\Client.exe
                                                          "C:\Program Files\Common Files\Client.exe"
                                                          18⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2168
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                            19⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2296
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bktKbHWPKI9H.bat" "
                                                            19⤵
                                                              PID:2124
                                                              • C:\Windows\system32\chcp.com
                                                                chcp 65001
                                                                20⤵
                                                                  PID:4068
                                                                • C:\Windows\system32\PING.EXE
                                                                  ping -n 10 localhost
                                                                  20⤵
                                                                  • Runs ping.exe
                                                                  PID:512
                                                                • C:\Program Files\Common Files\Client.exe
                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                  20⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1220
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                    21⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4872
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d8rhUQqspRVX.bat" "
                                                                    21⤵
                                                                      PID:3356
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 65001
                                                                        22⤵
                                                                          PID:4832
                                                                        • C:\Windows\system32\PING.EXE
                                                                          ping -n 10 localhost
                                                                          22⤵
                                                                          • Runs ping.exe
                                                                          PID:3624
                                                                        • C:\Program Files\Common Files\Client.exe
                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                          22⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4824
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                            23⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:3280
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bgjAKEgxfQIT.bat" "
                                                                            23⤵
                                                                              PID:2344
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                24⤵
                                                                                  PID:112
                                                                                • C:\Windows\system32\PING.EXE
                                                                                  ping -n 10 localhost
                                                                                  24⤵
                                                                                  • Runs ping.exe
                                                                                  PID:2432
                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                  24⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3692
                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                    25⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:1244
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeBu7aPugWui.bat" "
                                                                                    25⤵
                                                                                      PID:3752
                                                                                      • C:\Windows\system32\chcp.com
                                                                                        chcp 65001
                                                                                        26⤵
                                                                                          PID:948
                                                                                        • C:\Windows\system32\PING.EXE
                                                                                          ping -n 10 localhost
                                                                                          26⤵
                                                                                          • Runs ping.exe
                                                                                          PID:876
                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                          26⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4132
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                            27⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:1224
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XBEumwPGwjzM.bat" "
                                                                                            27⤵
                                                                                              PID:228
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                28⤵
                                                                                                  PID:4756
                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  28⤵
                                                                                                  • Runs ping.exe
                                                                                                  PID:2996
                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                  28⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1612
                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                    29⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4380
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yflMFBI3IkUM.bat" "
                                                                                                    29⤵
                                                                                                      PID:2692
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        30⤵
                                                                                                          PID:1576
                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                          ping -n 10 localhost
                                                                                                          30⤵
                                                                                                          • Runs ping.exe
                                                                                                          PID:4680
                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                          30⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4584
                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                            31⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:4152
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wN2haC3sLfVk.bat" "
                                                                                                            31⤵
                                                                                                              PID:3180
                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                chcp 65001
                                                                                                                32⤵
                                                                                                                  PID:1100
                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                  ping -n 10 localhost
                                                                                                                  32⤵
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:3396
                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                  32⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2828
                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                    33⤵
                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                    PID:116
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oxaI8cRKxP8O.bat" "
                                                                                                                    33⤵
                                                                                                                      PID:4740
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        34⤵
                                                                                                                          PID:888
                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                          ping -n 10 localhost
                                                                                                                          34⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:548
                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                          34⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5112
                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                            35⤵
                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                            PID:3324
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQb2sGQ7zpsX.bat" "
                                                                                                                            35⤵
                                                                                                                              PID:4168
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                36⤵
                                                                                                                                  PID:752
                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                  ping -n 10 localhost
                                                                                                                                  36⤵
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:2412
                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                  36⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:3828
                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                    37⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:980
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqljrWh26B6i.bat" "
                                                                                                                                    37⤵
                                                                                                                                      PID:1664
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        38⤵
                                                                                                                                          PID:1692
                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                          ping -n 10 localhost
                                                                                                                                          38⤵
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:2956
                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                          38⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4092
                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                            39⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:1724
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAPHP3eO1gh0.bat" "
                                                                                                                                            39⤵
                                                                                                                                              PID:1056
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                40⤵
                                                                                                                                                  PID:2648
                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                  40⤵
                                                                                                                                                  • Runs ping.exe
                                                                                                                                                  PID:2400
                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                  40⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2208
                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                    41⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:3880
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VxQvzUuU56wx.bat" "
                                                                                                                                                    41⤵
                                                                                                                                                      PID:3940
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        42⤵
                                                                                                                                                          PID:2160
                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                          42⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:2996
                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                          42⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2808
                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                            43⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:4500
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROlRyT63dnEl.bat" "
                                                                                                                                                            43⤵
                                                                                                                                                              PID:1292
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                44⤵
                                                                                                                                                                  PID:2764
                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:1548
                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:4440
                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                    45⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:2200
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gpbav95kcfqP.bat" "
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:1092
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        46⤵
                                                                                                                                                                          PID:2528
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                          46⤵
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:180
                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                          46⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:3528
                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                            47⤵
                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                            PID:3884
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iHeRBYZjR8bE.bat" "
                                                                                                                                                                            47⤵
                                                                                                                                                                              PID:2072
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                48⤵
                                                                                                                                                                                  PID:1736
                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                  48⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:2000
                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                  48⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:940
                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                    49⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:516
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1nUwduxQH15t.bat" "
                                                                                                                                                                                    49⤵
                                                                                                                                                                                      PID:1456
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        50⤵
                                                                                                                                                                                          PID:4168
                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                          50⤵
                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                          PID:5000
                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                          50⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:980
                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                            51⤵
                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                            PID:5024
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l94FOAWDHegm.bat" "
                                                                                                                                                                                            51⤵
                                                                                                                                                                                              PID:2968
                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                52⤵
                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                    PID:1744
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5daePeklLQFv.bat" "
                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m4vW7oyX5GsO.bat" "
                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                              PID:912
                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SiqsmBzcOCxq.bat" "
                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MVwJWKE7k8qj.bat" "
                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:3492
                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsO3C8uLrnmZ.bat" "
                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                      PID:456
                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:1184
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oubrzznW1q2P.bat" "
                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                  PID:844
                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:1692
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                    PID:840
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MIeA3PUcpdEE.bat" "
                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                          PID:1012
                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2020
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAYToWi2AZ1K.bat" "
                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgfDczUZzQIv.bat" "
                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                          PID:228
                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oInC2DXY36Ng.bat" "
                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o59c2KXZF3hZ.bat" "
                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                      PID:3836
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ON0bOeGcKPWy.bat" "
                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                  PID:3324
                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9sdHtkTvsKej.bat" "
                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                      PID:3572
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FANaXMSknSxW.bat" "
                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                  PID:392
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ZGq4XwVVzUe.bat" "
                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LutrLlLbVxoZ.bat" "
                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                  PID:5084
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iLl9cRymHfiT.bat" "
                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                      PID:2104
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmNnICVskvHx.bat" "
                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                              PID:780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                  PID:116
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ka7qntQgyIyY.bat" "
                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xKwvhMSmBeWs.bat" "
                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4488
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAEzsvulKqAb.bat" "
                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qfONVLCiRvfx.bat" "
                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAba5Uky3sfZ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LMDvnZl7UO36.bat" "
                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2RaCayx6yTxB.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                          PID:780
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1qfJK8mxytuS.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COYL3uSbc1Si.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i6s8Xtrq4Sff.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y39opqbpx8xn.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2KEnJIzI94hQ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ejMtZynZqvL8.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3920

                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                      2
                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1018

                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a121d9d691a400786000dee14a808ab1

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        14ab065be3cfe0a7aa7808cb8891f7c75affc395

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        7849231d077a00fd9129c2c6cecbb3287afc5656b8dfd263fdf57e2432d4f335

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        e0a162b3d00ef69b96bd4a43f9a0c3297005e8a8db84233010d420bf87ff337ed4139b4cc27594fdd194416a03fe8a7be90b03a8f10e34b72f70d399d6917929

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8f0271a63446aef01cf2bfc7b7c7976b

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1nUwduxQH15t.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a904a14818bd5b1c38d4be831bfb7291

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        5a7d618fa54b891a0c1b23deccbf8fe7138fa765

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        30e4aa39220c2ec3f4c87de031645ff7074e0d20dddf5edbcf4913e36fc10f8c

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9a41205ec03347a60f9428ebf589f24f7918b442c5f34a9d683c043d82b3891c5aaa658a448340e41c2338cdeea2e1d7581ccdf6a2c566e1922acda89921cec6

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2dqcK1cdBzLb.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8f3dc61037f4c85bf302e674a1fba3a3

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        484433b0ed82d0d1eaece2566817c29f4e657343

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        9bed1575bb7c307acb855bcdc4c5337e7f79373a3c95c5f7349ba4578fc6a773

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f33a2ca5bb900c884b279d7edf3047f8194b77f7430f00fb56e5ec590ee7f3c4c450e430f146643df591cae5df9891ec11f99aa116f78fe172047eb6aeda6be9

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\35GueDsOjmBq.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        ae481b36a543a5a8d60f2c4c38621932

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ef7311f7df2d99928f39fa8926aca25a261de6f5

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        c057f12faed7af2f9f8581589f887965c35f4cd94fa264f8898d7436db7bde79

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        912120b24d36c280a340f93b2387ee91a1725a7b65201cafae206fc34bd1dbac2c1d2d425ea03b5f9cc24170ad56bec22448433efcd2c70e76463e2c09228e8b

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5daePeklLQFv.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        cc73350a3777fb5a02fb02d80d48dcb3

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        b5486a1cd948200dbb1db0bf48649f07823f3a27

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        85a5c71fb5cf5f79e135ce1f7607733b2685c4e2116d4cb366a4c0f00650dfe3

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9fae069bb1531c801c85ed8e9e591b8634ce8013c4d4b1f39f0f6f87092a67da1bbb89a3bf6a3e34091110c3821668e3cd6a397c45fc37a80286894ffa2ed162

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6kamOhoB7mVe.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        71ce71d200cf69a8ce88e218e2723603

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        bceb5329259b5d114c2a6f49f1628b22e5a31978

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f915cbc57428c95d6b2e79f224824e53169d8b61adf6f7428f98da1734719846

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        a75e240f4fb903972f483bb3f14f61f399e6e392df527fa2ee83c22f2d8d112a805c5f1b43739f1ba1583df7df5ffa46978b086ba4656de736ca010912ac213b

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9milzwDyGjow.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4b24b26714d12621631450a70fc615b8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        90ff08f7108c116eebdd80c204a78a1ff866393a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        b986f6068f56f58cc29f4868508b17577f68009fcee09fad8147c15a59a137ff

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        a6282f94ea4cedc984cea0433a8e1083d855935272b1699afd5f95548a3d7fbc396395a37a65fe663f13dd59a92fd6f96cd876fb7a7464fd5e48ecee2297d5f7

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AE5Czrl8ZSxU.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a7fe8aa7c5136be6e86b9bce0d49372d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8ddc65ce61b86148a3d7e2226f2912451618f6f8

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        c308b943190efd3f3cf4df8084d202b2a762c816410636930eff51a9bba1b5af

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        1accd79d28b1e9c42911aa53a5907556cc0beb44196f41c2f59cc524c748701f688e421cebf22e0ced7c0e692fee19f9c83156a454807e31ce39baab633cc013

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CjqbtOpWkCeY.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2671e265823ad106d8e2cc6ae372dc4f

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        72387f1e9de3f868ec3b33be7f4483c25b57805a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        de7c528e9e645c2777565cc36e2b1d5783465fb0e66d4caab8cb86f886fb4e92

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8562018c6628cc8cea5b826451ea147a9f40a1a7b104458f23053233f76a6ac5546f582493212d375f062dae7fd156d336fb913c4147718b5162f5f52287bdb7

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Gpbav95kcfqP.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        6a379bffab6019339903c634bfc759d4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        813a187093f75959f999b1e1efe174efd3a5e203

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3e9c0c00daeff32001c85721aac4a3d3b0e1a2a869f480486faf9c77c930233d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        cbe0179706c86b53a1866044367f266c804150d4ce5bacf6f1d2f5f95250037c186710fb748ada85a91693179783cd97780998be62111a9d1d97d68e12a28f51

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\HsO3C8uLrnmZ.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        b3115de8a7a25b53b8b098b63410f74b

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        7baa36cc11409ae64e1699c58a3ad8e7f028ce7f

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        5e44bf0e27b7543310c48b269ad2f87be9c079c0d2540be1aae4f662e772fdf3

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        435271c997659e0ccd53cfaeb7517df83e3ca7547646bf786c9f59e6c85f4451db28cf0d87bdb6d1557e2fb3a20020c137ba8f6a2874cc232be9e9be049720ff

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LAwaLImXzJgM.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f6c25f5c01f89ca28a4f60c7d90effc6

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        d5b6c63450ca9c2305b857e78e9347fd0de8f58f

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        85cc56c10c7a3a2f8c29ba3a4e06033a1aa1f62473edd855e579d25c94693065

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        16644857ba9953daa4b2ca1e6bbdd5f03708ad559a9be02632005629ce1aa4a947c05dff531717a9c0decc6e06f40aab716c0d93357e71a809eb8f4579acc39a

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LeBu7aPugWui.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        cea4cfdcc4274a680a6f31a49245c7af

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        3c7a46af255fea86b4e2f47c9c8d73543074c8e0

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        a112b27cc1c518c38a9e85973b3230d5ffcb2fe1ac5060a61eb1dec4b63144ee

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        0f45654f95bd17a4670ffec1dc15517261a73b6f6dd02f3c8a88a440aa325be7215aa6e4bf853fbf4e81eb98767d144d8500482775027f53cfeb0863546cbafc

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MVwJWKE7k8qj.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        70391ac50c0dfb7e30888bb051de1200

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        afabbc2705aac155cdabca892d81b025c5ba8cd0

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        0e6fa2e0024094933945fb4ae4fe007467bbeb39b7876b7216bff6d2d13e8dc7

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        269eb0d5b147377bf13b12ea99660b485bc70663c1b0e09331c8dba8f8f1e39bdb0f2ae9c0d5dab6a8df9b90db05546b5f167cfe5aea0fb82ce11e747cc565bd

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RAPHP3eO1gh0.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        22e5138c1615c1d4a0e98b7e5b2d8a24

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        3c81ee09fe251ad2ead4b2b7b1afd1c86db9a36e

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        bf906992a53117ac707794d4e9cc09be11a4f89cfdaf08561fde20243734d861

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8e9078f16467cd7b916aca728e519d65a6c367bbc5e6f5ad7b0945ccec5fe6aead30bd77e36812df41b1e9257dab6aa88743a3cd7642bcc5383c1b2a311145f0

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ROlRyT63dnEl.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        e910e760d56f7cba21b91bcca8af520a

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        b12f6b93dbaade8657ad71e794890722a5899d03

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6f8d82f9e6bae6e82d0b5ea84bd3dbebd1b2f5316ad593fe0ad0718426f49ab6

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3806f90d2223bc0d8b18c9bd24f933e2d39554fad173007dc5a915ec1dd4468d324e258b6b05a89cc6aa4176d792d6c2faa93306ffaea60d1ccb74b2bf715eb0

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SiqsmBzcOCxq.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8fb661be6a35c316fc9b6e11cca79616

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        f560c4f87eec0d005e20bfdee0cb417e0d3cc81a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        342703a9b35c4a7b250c7bee06190d64789b5130763a84e83fce727bb4809d2f

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d7a2a563f2dd81cef935599736302206291eb2bcd1f0d15e5400e60986828778c344d26f349659a03457d594fec69bf0bdf9b11ba651349bc56ba82fcd0d8a33

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\VxQvzUuU56wx.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        0127f4f318c32e892119db0ef6ab8206

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        db8ee9e3c4078463acad89cf9b4703adce714682

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        d9b2a24dc5163586004e170882d242012b4cd8a0d3575b36871ca86ad6e4cca7

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20a087e640d434d2a2bfaedf1f7c7c2d12213a661e83f6c8a0c31080b769f8027e39513f4cf9c5b051c2eba675ea570a2b96c1f1ccb16aa38cfb0a75d2982344

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XBEumwPGwjzM.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        ebaa209f30f42642062f83de2013bea6

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        a656dfbc6a101662f7b1dbc226f2db49c7d28380

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        a74dff5c62b739310ba1bb7d9da842f4cc42ca02356d8338839765d0d7654b9a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        e51eacb4b733bc464c3be79590407443d7df0217d1681ccd9970e340dce5e1e2f93e7480cf8c5e2e3691ddfe5574c62697f8be54f30b31cf09aeed005be61791

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bgjAKEgxfQIT.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        c87cc7778a41a1b1b849d6c29493e0e5

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        d5b60076e9d9ac7f9397cc83619c2b58922c7483

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2b56f241133a17464afe0deacd78569180be2b00c0c85dd7e41c81a66721655e

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3a146a05dc97847300dea5e044e1b50cf8d122b5fcaae10eb63b51bc3dd5f2b7f8b123eca50269e61cfcc47165f764456cba34aafd1ac3769ce71f859cc0d619

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bktKbHWPKI9H.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        7242875920f50881eef75fe32b9f9ce7

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        c886f1db9ab01c0f5ee2c70dbd445f20bf23809f

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        50741272e040a427aabda2655911b4fb6fd34a5e7f542fb2f70c469a57ee42a0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        78d7d7a424388ce26fa57bf7c2eae403c7f3812784d67be51f38b2cf56198f1297bc15643c0dcf25bedaa658cae64b4bd69318cb2a0153dad3ddb3f052fd7b13

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d8rhUQqspRVX.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        5f8fa8c00508f37ea4e7b1ca9c7645ed

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        025d23fff0985d6786e2f0568c0be181a7f3cdb0

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4709d4379846f412ef86e7bdc8f756014a88884ccb98afa6323903ad345761a1

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        64f3978c4e4f6ef3b42f4975c56e07de0121520c751d29e97c72a136b8e3635f059b14cb6c4d8285db62a0c9e085d294b8e66bb357a5f71be0ea1ba80d8abece

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hQb2sGQ7zpsX.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        43f838fbadc36ce4e330f687604aa531

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        58faf8a07bbd512655668cd2834de794d1b59446

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        cfe99d0dafe47b5fde8d4e1171d4a130fe66f2ed3fd6c0e7d44500e0121a0654

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        80e3584dc90b27783e3a06a5f1ee67900bbcfe7a34a1cc33167c0a0e64fb306de3e29f002ab6f1e131105eea51eb9b4738f8fa08e1f6858abca14f3dc0a37c30

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\iHeRBYZjR8bE.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        9f40c2670dce22f9d0b4f78c9b44e2c4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        5b729734070fdae0afc8485de344177b968ed44d

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        b784910b80b4465edc54c7d69233756a28e91c081656c15201b952453166e247

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        984a2219d30178b7ab3a450c296984dfcb6c1f8e4bb82fee954dc665c9aff2c2b498189e515aba0fef233a835f57b72e6ce97d487b239e983026898cca9f765f

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kNmGobdPK4ej.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        3d7bf32da5d1527cb527d125fc7ed0c9

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        dce760fabae15428aeb5a5017520193132065e2a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        20240d9b2c3b63f6d5a5c4c794d9700ee4cbd2e02f6260722c333b15f1c42a04

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        de232870cbd26c9fd64548603ca80d7a857bb8644bed9951134b0fd4233502afa0cf38a3f5bde85a02ea6f18196b7cb0df01a923039addeaf4f31ffab4f1c403

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\l94FOAWDHegm.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a6aff218d36c7910e648656e5b97162e

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ffbebf94a0b821fc1307943a20b6cac771cccb6b

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        53261430c523d540ae82b1463824f603416cdf5fbea7c8797c0d8f78069c1dca

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d57a994f5bbd2eb19da79303dc22c6010ed71536c90e7859f493e55767058b1a736055095dc2763d1e1b4b618d18952c844c22698db3cf473b936bb2e7aaf4d9

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\m4vW7oyX5GsO.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        3dd0348db3b2683b7a067861436f4dcb

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        bfaca2c3467f071936ef7b7f6a57e68831736178

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        a3b008a6c486795dee94a510598235db01435be9db5854cdca9cc084c748b542

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        c180212abb4eed8f3fb87c9da18faec7c4b20fb7b0c6009a736d0079744604158a543bf26d8a432ac42a1974a22d54f08221dfe84657ce1a35db448a8a26679e

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\oubrzznW1q2P.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        933266bba4833a996176cd3d177d4bdf

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8d89d8c040da879d0b3dc8d49fd84e6bea6b17c6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2b7164f2545d7812736b5674946c1a77459d74e00879a2eb4a7b2d1fbe526f8f

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        7e2feaa4f943f110a27b34923636c623be415dc247149b4a4728db5c975706c463ecfed1dc9df4041ad2a64c0d1c57394ea10a0dc05dcb9ace3341531ecf863d

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\oxaI8cRKxP8O.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        c194087b34e0217874caad4a05d7d5d1

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        dcf78e05f14222a8da86857129aa5f2ed0805ccd

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2541eadd4ffd65fa09cdb19e0ca05dafec1257fd2ff9e3d6aabc8d56e9f90187

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        de0ce9559d9465c6c31d18e9abb547ab440c1871422463b682a75fa14d2bd393fa7fbab6df6e16e2a3bb611d49f9f70d73a93b0fc4abf3428443ff6d2c2ce49a

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tqljrWh26B6i.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        499b9e431f47f286f93a52cb40445db9

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        cf92fcbb35ae90826ecd2c846f38eaa262d30746

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3aff9634454b2f03090ba0d18bf4019ef7f3502d54e40b53aee65dc3069c09cc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        b48b8f4432dfb01d4afc8c9b2a31c9dcf8244ea98aa9b3db7b0dbd58c80d374de23a6acdf66f4b6dcc053a653f5457969e2c38861f9831cd1d18d670f510b37b

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\wN2haC3sLfVk.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        5063706f18294056f8ac6273700a5fe3

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        cd65a274446f38b4d927b6c36273a37d1e7a7501

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        1d3de1bafc3c4149c0971017a070b73cb3f2d2a74ef24625b7d33bfa8c27a058

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9f7453218c090045574dd79c2c1a8494b6b456acd0aac37a7842fa6b8861d5563afbd57c49fa15236dae73e4ead8e6a4ab6fd3d504757a0fbce206ba70d35375

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yflMFBI3IkUM.bat
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        199B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        46b3352865e70f1eb5657126a8cc1000

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        7e8834e33af50ea0b13ac4d8e65544642eb6a769

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        bfaa8a324f7527fdce16bf15a078b9aae2dd611cc30d789233eacc0223d09f89

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        6794c412ed2cfdb0c6e5cf90a7d8e9ff294c7033d09c7f76cdb09799bc5f22c55e45d19f0690eef3331f3ec09992727409878e65bbc7838668d519a76a3263ae

                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                      • memory/1456-0-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1456-1-0x0000000000970000-0x0000000000C94000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1456-2-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1456-9-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1992-18-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1992-10-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1992-11-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1992-12-0x000000001E310000-0x000000001E360000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                      • memory/1992-13-0x000000001E420000-0x000000001E4D2000-memory.dmp
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        712KB

                                                                                                                                                                                                                        Download