quasar | 753e958ea04ee6a765f09e2ca60f56cc2959bb45aea66a77ee6ba3326cb36720

Analysis

max time kernel
1791s
max time network
1793s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
06/04/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240406-yk91nahd4v
SHA256 753e958ea04ee6a765f09e2ca60f56cc2959bb45aea66a77ee6ba3326cb36720
MD5 49a65e235d14a56d3043ddd95790e68d
SHA1 e3418e08e2c869b4970faa7f8ac166129a038770
SHA512 7e8a30bd9dd0ab92ad673f540ec6cb4f841baf57b2593618c0106fc385cfd69405b46d7b757a440d18d5c0dcc6273cd8589b5c389a1d76899ea7ffe6d603794e
SSDEEP 49152:Sv2I22SsaNYfdPBldt698dBcjH63eG0+DvJkwoGdhTHHB72eh2NT:Svb22SsaNYfdPBldt6+dBcjH/+v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

wasted9sss1-56353.portmap.host:4782

Mutex

f6d58747-a97c-4537-9d9d-312d4a425082

Attributes

encryption_key
517C077DB1E3D3485387F0B31BBF986E71312477
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
system32
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2232-0-0x0000000000AA0000-0x0000000000DC4000-memory.dmp	family_quasar
behavioral2/files/0x000200000002a7c4-5.dat	family_quasar

Executes dropped EXE 64 IoCs

pid	Process
4528	Client.exe
2200	Client.exe
1388	Client.exe
332	Client.exe
976	Client.exe
1072	Client.exe
4920	Client.exe
4992	Client.exe
3332	Client.exe
4068	Client.exe
3480	Client.exe
5004	Client.exe
3136	Client.exe
2192	Client.exe
4052	Client.exe
3112	Client.exe
1920	Client.exe
1712	Client.exe
4144	Client.exe
2556	Client.exe
2988	Client.exe
2608	Client.exe
924	Client.exe
1212	Client.exe
4436	Client.exe
5040	Client.exe
3160	Client.exe
2736	Client.exe
2316	Client.exe
864	Client.exe
472	Client.exe
2056	Client.exe
3948	Client.exe
2660	Client.exe
4288	Client.exe
1548	Client.exe
2428	Client.exe
2216	Client.exe
4072	Client.exe
2732	Client.exe
1652	Client.exe
3176	Client.exe
1820	Client.exe
1484	Client.exe
3656	Client.exe
2956	Client.exe
232	Client.exe
3032	Client.exe
3680	Client.exe
3520	Client.exe
2128	Client.exe
4056	Client.exe
4224	Client.exe
2676	Client.exe
3216	Client.exe
4112	Client.exe
3544	Client.exe
3960	Client.exe
2080	Client.exe
2928	Client.exe
1452	Client.exe
876	Client.exe
1800	Client.exe
4544	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3608	schtasks.exe
3236	schtasks.exe
2324	schtasks.exe
928	schtasks.exe
2520	schtasks.exe
3944	schtasks.exe
2896	schtasks.exe
1908	schtasks.exe
4540	schtasks.exe
900	schtasks.exe
1004	schtasks.exe
1564	schtasks.exe
2208	schtasks.exe
4984	schtasks.exe
2752	schtasks.exe
3748	schtasks.exe
840	schtasks.exe
2176	schtasks.exe
2096	schtasks.exe
2720	schtasks.exe
3776	schtasks.exe
3036	schtasks.exe
2652	schtasks.exe
676	schtasks.exe
4516	schtasks.exe
3244	schtasks.exe
3084	schtasks.exe
1528	schtasks.exe
3432	schtasks.exe
2464	schtasks.exe
344	schtasks.exe
656	schtasks.exe
2600	schtasks.exe
572	schtasks.exe
4568	schtasks.exe
3736	schtasks.exe
4960	schtasks.exe
4116	schtasks.exe
1312	schtasks.exe
3544	schtasks.exe
2932	schtasks.exe
3016	schtasks.exe
2868	schtasks.exe
3932	schtasks.exe
4832	schtasks.exe
432	schtasks.exe
3252	schtasks.exe
2444	schtasks.exe
3860	schtasks.exe
4976	schtasks.exe
4980	schtasks.exe
3680	schtasks.exe
3276	schtasks.exe
2092	schtasks.exe
2512	schtasks.exe
1788	schtasks.exe
4148	schtasks.exe
2348	schtasks.exe
2968	schtasks.exe
1316	schtasks.exe
2520	schtasks.exe
1828	schtasks.exe
1264	schtasks.exe
2716	schtasks.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
3020	PING.EXE
4508	PING.EXE
1644	PING.EXE
1928	PING.EXE
3988	PING.EXE
4140	PING.EXE
3240	PING.EXE
5108	PING.EXE
2464	PING.EXE
3404	PING.EXE
4352	PING.EXE
3472	PING.EXE
3916	PING.EXE
4036	PING.EXE
2156	PING.EXE
2288	PING.EXE
3228	PING.EXE
4384	PING.EXE
2892	PING.EXE
656	PING.EXE
4968	PING.EXE
3860	PING.EXE
5036	PING.EXE
1500	PING.EXE
928	PING.EXE
1668	PING.EXE
3992	PING.EXE
1020	PING.EXE
1476	PING.EXE
5048	PING.EXE
1000	PING.EXE
1444	PING.EXE
4972	PING.EXE
4840	PING.EXE
1472	PING.EXE
2720	PING.EXE
1916	PING.EXE
3828	PING.EXE
4420	PING.EXE
2208	PING.EXE
432	PING.EXE
344	PING.EXE
2216	PING.EXE
3152	PING.EXE
1604	PING.EXE
4660	PING.EXE
2716	PING.EXE
1196	PING.EXE
2460	PING.EXE
2580	PING.EXE
4272	PING.EXE
2924	PING.EXE
1660	PING.EXE
3976	PING.EXE
1684	PING.EXE
4868	PING.EXE
2380	PING.EXE
3324	PING.EXE
3688	PING.EXE
4980	PING.EXE
3548	PING.EXE
2536	PING.EXE
476	PING.EXE
4592	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	Client-built.exe
Token: SeDebugPrivilege	4528	Client.exe
Token: SeDebugPrivilege	2200	Client.exe
Token: SeDebugPrivilege	1388	Client.exe
Token: SeDebugPrivilege	332	Client.exe
Token: SeDebugPrivilege	976	Client.exe
Token: SeDebugPrivilege	1072	Client.exe
Token: SeDebugPrivilege	4920	Client.exe
Token: SeDebugPrivilege	4992	Client.exe
Token: SeDebugPrivilege	3332	Client.exe
Token: SeDebugPrivilege	4068	Client.exe
Token: SeDebugPrivilege	3480	Client.exe
Token: SeDebugPrivilege	5004	Client.exe
Token: SeDebugPrivilege	3136	Client.exe
Token: SeDebugPrivilege	2192	Client.exe
Token: SeDebugPrivilege	4052	Client.exe
Token: SeDebugPrivilege	3112	Client.exe
Token: SeDebugPrivilege	1920	Client.exe
Token: SeDebugPrivilege	1712	Client.exe
Token: SeDebugPrivilege	4144	Client.exe
Token: SeDebugPrivilege	2556	Client.exe
Token: SeDebugPrivilege	2988	Client.exe
Token: SeDebugPrivilege	2608	Client.exe
Token: SeDebugPrivilege	924	Client.exe
Token: SeDebugPrivilege	1212	Client.exe
Token: SeDebugPrivilege	4436	Client.exe
Token: SeDebugPrivilege	5040	Client.exe
Token: SeDebugPrivilege	3160	Client.exe
Token: SeDebugPrivilege	2736	Client.exe
Token: SeDebugPrivilege	2316	Client.exe
Token: SeDebugPrivilege	864	Client.exe
Token: SeDebugPrivilege	472	Client.exe
Token: SeDebugPrivilege	2056	Client.exe
Token: SeDebugPrivilege	3948	Client.exe
Token: SeDebugPrivilege	2660	Client.exe
Token: SeDebugPrivilege	4288	Client.exe
Token: SeDebugPrivilege	1548	Client.exe
Token: SeDebugPrivilege	2428	Client.exe
Token: SeDebugPrivilege	2216	Client.exe
Token: SeDebugPrivilege	4072	Client.exe
Token: SeDebugPrivilege	2732	Client.exe
Token: SeDebugPrivilege	1652	Client.exe
Token: SeDebugPrivilege	3176	Client.exe
Token: SeDebugPrivilege	1820	Client.exe
Token: SeDebugPrivilege	1484	Client.exe
Token: SeDebugPrivilege	3656	Client.exe
Token: SeDebugPrivilege	2956	Client.exe
Token: SeDebugPrivilege	232	Client.exe
Token: SeDebugPrivilege	3032	Client.exe
Token: SeDebugPrivilege	3680	Client.exe
Token: SeDebugPrivilege	3520	Client.exe
Token: SeDebugPrivilege	2128	Client.exe
Token: SeDebugPrivilege	4056	Client.exe
Token: SeDebugPrivilege	4224	Client.exe
Token: SeDebugPrivilege	2676	Client.exe
Token: SeDebugPrivilege	3216	Client.exe
Token: SeDebugPrivilege	4112	Client.exe
Token: SeDebugPrivilege	3544	Client.exe
Token: SeDebugPrivilege	3960	Client.exe
Token: SeDebugPrivilege	2080	Client.exe
Token: SeDebugPrivilege	2928	Client.exe
Token: SeDebugPrivilege	1452	Client.exe
Token: SeDebugPrivilege	876	Client.exe
Token: SeDebugPrivilege	1800	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4528	Client.exe
2200	Client.exe
1388	Client.exe
332	Client.exe
976	Client.exe
1072	Client.exe
4920	Client.exe
4992	Client.exe
3332	Client.exe
4068	Client.exe
3480	Client.exe
5004	Client.exe
3136	Client.exe
2192	Client.exe
4052	Client.exe
3112	Client.exe
1920	Client.exe
1712	Client.exe
4144	Client.exe
2556	Client.exe
2988	Client.exe
2608	Client.exe
924	Client.exe
1212	Client.exe
4436	Client.exe
5040	Client.exe
3160	Client.exe
2736	Client.exe
2316	Client.exe
864	Client.exe
472	Client.exe
2056	Client.exe
3948	Client.exe
2660	Client.exe
4288	Client.exe
1548	Client.exe
2428	Client.exe
2216	Client.exe
4072	Client.exe
2732	Client.exe
1652	Client.exe
3176	Client.exe
1820	Client.exe
1484	Client.exe
3656	Client.exe
2956	Client.exe
232	Client.exe
3032	Client.exe
3680	Client.exe
3520	Client.exe
2128	Client.exe
4056	Client.exe
4224	Client.exe
2676	Client.exe
3216	Client.exe
4112	Client.exe
3544	Client.exe
3960	Client.exe
2080	Client.exe
2928	Client.exe
1452	Client.exe
876	Client.exe
1800	Client.exe
4544	Client.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4528	Client.exe
2200	Client.exe
1388	Client.exe
332	Client.exe
976	Client.exe
1072	Client.exe
4920	Client.exe
4992	Client.exe
3332	Client.exe
4068	Client.exe
3480	Client.exe
5004	Client.exe
3136	Client.exe
2192	Client.exe
4052	Client.exe
3112	Client.exe
1920	Client.exe
1712	Client.exe
4144	Client.exe
2556	Client.exe
2988	Client.exe
2608	Client.exe
924	Client.exe
1212	Client.exe
4436	Client.exe
5040	Client.exe
3160	Client.exe
2736	Client.exe
2316	Client.exe
864	Client.exe
472	Client.exe
2056	Client.exe
3948	Client.exe
2660	Client.exe
4288	Client.exe
1548	Client.exe
2428	Client.exe
2216	Client.exe
4072	Client.exe
2732	Client.exe
1652	Client.exe
3176	Client.exe
1820	Client.exe
1484	Client.exe
3656	Client.exe
2956	Client.exe
232	Client.exe
3032	Client.exe
3680	Client.exe
3520	Client.exe
2128	Client.exe
4056	Client.exe
4224	Client.exe
2676	Client.exe
3216	Client.exe
4112	Client.exe
3544	Client.exe
3960	Client.exe
2080	Client.exe
2928	Client.exe
1452	Client.exe
876	Client.exe
1800	Client.exe
4544	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2968	2232	Client-built.exe	78
PID 2232 wrote to memory of 2968	2232	Client-built.exe	78
PID 2232 wrote to memory of 4528	2232	Client-built.exe	80
PID 2232 wrote to memory of 4528	2232	Client-built.exe	80
PID 4528 wrote to memory of 1264	4528	Client.exe	81
PID 4528 wrote to memory of 1264	4528	Client.exe	81
PID 4528 wrote to memory of 4144	4528	Client.exe	83
PID 4528 wrote to memory of 4144	4528	Client.exe	83
PID 4144 wrote to memory of 4552	4144	cmd.exe	85
PID 4144 wrote to memory of 4552	4144	cmd.exe	85
PID 4144 wrote to memory of 2452	4144	cmd.exe	86
PID 4144 wrote to memory of 2452	4144	cmd.exe	86
PID 4144 wrote to memory of 2200	4144	cmd.exe	87
PID 4144 wrote to memory of 2200	4144	cmd.exe	87
PID 2200 wrote to memory of 3748	2200	Client.exe	88
PID 2200 wrote to memory of 3748	2200	Client.exe	88
PID 2200 wrote to memory of 3968	2200	Client.exe	90
PID 2200 wrote to memory of 3968	2200	Client.exe	90
PID 3968 wrote to memory of 1524	3968	cmd.exe	92
PID 3968 wrote to memory of 1524	3968	cmd.exe	92
PID 3968 wrote to memory of 4804	3968	cmd.exe	93
PID 3968 wrote to memory of 4804	3968	cmd.exe	93
PID 3968 wrote to memory of 1388	3968	cmd.exe	94
PID 3968 wrote to memory of 1388	3968	cmd.exe	94
PID 1388 wrote to memory of 2720	1388	Client.exe	95
PID 1388 wrote to memory of 2720	1388	Client.exe	95
PID 1388 wrote to memory of 2524	1388	Client.exe	97
PID 1388 wrote to memory of 2524	1388	Client.exe	97
PID 2524 wrote to memory of 3904	2524	cmd.exe	99
PID 2524 wrote to memory of 3904	2524	cmd.exe	99
PID 2524 wrote to memory of 2536	2524	cmd.exe	100
PID 2524 wrote to memory of 2536	2524	cmd.exe	100
PID 2524 wrote to memory of 332	2524	cmd.exe	101
PID 2524 wrote to memory of 332	2524	cmd.exe	101
PID 332 wrote to memory of 3544	332	Client.exe	102
PID 332 wrote to memory of 3544	332	Client.exe	102
PID 332 wrote to memory of 4976	332	Client.exe	104
PID 332 wrote to memory of 4976	332	Client.exe	104
PID 4976 wrote to memory of 1360	4976	cmd.exe	106
PID 4976 wrote to memory of 1360	4976	cmd.exe	106
PID 4976 wrote to memory of 5036	4976	cmd.exe	107
PID 4976 wrote to memory of 5036	4976	cmd.exe	107
PID 4976 wrote to memory of 976	4976	cmd.exe	108
PID 4976 wrote to memory of 976	4976	cmd.exe	108
PID 976 wrote to memory of 4492	976	Client.exe	109
PID 976 wrote to memory of 4492	976	Client.exe	109
PID 976 wrote to memory of 948	976	Client.exe	111
PID 976 wrote to memory of 948	976	Client.exe	111
PID 948 wrote to memory of 8	948	cmd.exe	113
PID 948 wrote to memory of 8	948	cmd.exe	113
PID 948 wrote to memory of 1088	948	cmd.exe	114
PID 948 wrote to memory of 1088	948	cmd.exe	114
PID 948 wrote to memory of 1072	948	cmd.exe	115
PID 948 wrote to memory of 1072	948	cmd.exe	115
PID 1072 wrote to memory of 2520	1072	Client.exe	116
PID 1072 wrote to memory of 2520	1072	Client.exe	116
PID 1072 wrote to memory of 2056	1072	Client.exe	118
PID 1072 wrote to memory of 2056	1072	Client.exe	118
PID 2056 wrote to memory of 488	2056	cmd.exe	120
PID 2056 wrote to memory of 488	2056	cmd.exe	120
PID 2056 wrote to memory of 1212	2056	cmd.exe	121
PID 2056 wrote to memory of 1212	2056	cmd.exe	121
PID 2056 wrote to memory of 4920	2056	cmd.exe	122
PID 2056 wrote to memory of 4920	2056	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2968
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\06AREvMDpBvJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4552
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\APQOGQeqkQlt.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1524
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        
        PID:2720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0pa3gzdzoAxn.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9nXOBA5qn6Ru.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:5036
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        
        PID:4492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OBcqqA4Ix0sR.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:8
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rMA0MTfMFrHq.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        
        PID:3220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LjrlIKs6rGvs.bat" "
        15⤵
        
        PID:3124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ojy4onKfa7KS.bat" "
        17⤵
        
        PID:2824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        
        PID:3760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A7dTJEAEdoUl.bat" "
        19⤵
        
        PID:3188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LNT4s01VPvjn.bat" "
        21⤵
        
        PID:2176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        
        PID:3664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ElhD2exBbFvd.bat" "
        23⤵
        
        PID:3244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5004
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        
        PID:1904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmZGMCoUu1LQ.bat" "
        25⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:3916
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3136
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gM9ZfPxnMa68.bat" "
        27⤵
        
        PID:864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4364
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:1916
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Creates scheduled task(s)
        
        PID:1316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DnVNLfD2wFdb.bat" "
        29⤵
        
        PID:1984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4052
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Creates scheduled task(s)
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOj2IucTTutO.bat" "
        31⤵
        
        PID:2260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3112
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        33⤵
        
        PID:1000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nFIcwG2MNtL9.bat" "
        33⤵
        
        PID:72
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:1308
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        34⤵
        Runs ping.exe
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        35⤵
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CZKgwE8tKFgU.bat" "
        35⤵
        
        PID:3724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:2960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1712
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        37⤵
        
        PID:3976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BAkBRPuvCmo4.bat" "
        37⤵
        
        PID:2292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        38⤵
        
        PID:4556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        38⤵
        Runs ping.exe
        
        PID:4420
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4144
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        39⤵
        Creates scheduled task(s)
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RntT1bEBvKY2.bat" "
        39⤵
        
        PID:4312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        40⤵
        
        PID:400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        40⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2556
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        41⤵
        Creates scheduled task(s)
        
        PID:3608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n7aSt7rnPBIT.bat" "
        41⤵
        
        PID:3540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        42⤵
        
        PID:1564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        42⤵
        Runs ping.exe
        
        PID:4384
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2988
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        43⤵
        Creates scheduled task(s)
        
        PID:676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIinSDjruKAf.bat" "
        43⤵
        
        PID:1360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        44⤵
        
        PID:4220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        44⤵
        Runs ping.exe
        
        PID:2216
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2608
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        45⤵
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BJpfVUp0xDVY.bat" "
        45⤵
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        46⤵
        
        PID:1280
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        46⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        47⤵
        Creates scheduled task(s)
        
        PID:1908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6S1p2NkrEn92.bat" "
        47⤵
        
        PID:2520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        48⤵
        
        PID:1824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        48⤵
        Runs ping.exe
        
        PID:2380
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        49⤵
        Creates scheduled task(s)
        
        PID:3736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naIOdxTjGyw3.bat" "
        49⤵
        
        PID:2704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        50⤵
        
        PID:3516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        50⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        51⤵
        Creates scheduled task(s)
        
        PID:2652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LH820fI1YCI0.bat" "
        51⤵
        
        PID:4368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        52⤵
        
        PID:788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        52⤵
        Runs ping.exe
        
        PID:3992
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5040
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        53⤵
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8rN2rHMJyNCy.bat" "
        53⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        54⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        54⤵
        Runs ping.exe
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        55⤵
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j4Z3QG29WfBK.bat" "
        55⤵
        
        PID:2008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        56⤵
        
        PID:240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        56⤵
        Runs ping.exe
        
        PID:3324
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        57⤵
        Creates scheduled task(s)
        
        PID:344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LNMTqPetoQPd.bat" "
        57⤵
        
        PID:132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        58⤵
        
        PID:1628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        58⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        58⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        59⤵
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d70hj6R3P8YY.bat" "
        59⤵
        
        PID:4696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        60⤵
        
        PID:4888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        60⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:864
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        61⤵
        Creates scheduled task(s)
        
        PID:4976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4mUrhO9KqmU2.bat" "
        61⤵
        
        PID:2676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        62⤵
        
        PID:2248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        62⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        62⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:472
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        63⤵
        
        PID:232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vXGcfh1PQuHB.bat" "
        63⤵
        
        PID:1824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        64⤵
        
        PID:4176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        64⤵
        Runs ping.exe
        
        PID:1500
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        64⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2056
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        65⤵
        
        PID:2072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SDavqI06eyH8.bat" "
        65⤵
        
        PID:2300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        66⤵
        
        PID:4104
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        66⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        66⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        67⤵
        Creates scheduled task(s)
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FVFw1q4sFemn.bat" "
        67⤵
        
        PID:3120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        68⤵
        
        PID:3180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        68⤵
        Runs ping.exe
        
        PID:2580
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        68⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        69⤵
        Creates scheduled task(s)
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7kwuejnPZqlV.bat" "
        69⤵
        
        PID:3640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        70⤵
        
        PID:3196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        70⤵
        Runs ping.exe
        
        PID:4272
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        70⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4288
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        71⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HvaJGBCeVt7Z.bat" "
        71⤵
        
        PID:3164
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        72⤵
        
        PID:4964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        72⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        72⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1548
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        73⤵
        Creates scheduled task(s)
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xNb7qhOjFU4u.bat" "
        73⤵
        
        PID:3932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        74⤵
        
        PID:1628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        74⤵
        Runs ping.exe
        
        PID:4036
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        74⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2428
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        75⤵
        Creates scheduled task(s)
        
        PID:656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C1rR329zyvwW.bat" "
        75⤵
        
        PID:2416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        76⤵
        
        PID:2096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        76⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        76⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2216
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        77⤵
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7JMKpqdjpF0x.bat" "
        77⤵
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        78⤵
        
        PID:4204
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        78⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        78⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4072
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        79⤵
        
        PID:3128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1cVXB2dWhsjw.bat" "
        79⤵
        
        PID:2212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        80⤵
        
        PID:2380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        80⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        80⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        81⤵
        Creates scheduled task(s)
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9v663RCZ6Xco.bat" "
        81⤵
        
        PID:1324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        82⤵
        
        PID:2156
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        82⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        82⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1652
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        83⤵
        Creates scheduled task(s)
        
        PID:3680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\drYZxgseHQ4h.bat" "
        83⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        84⤵
        
        PID:2652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        84⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        84⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3176
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        85⤵
        
        PID:2152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEkcj3m1Q6Lk.bat" "
        85⤵
        
        PID:4604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        86⤵
        
        PID:1444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        86⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        86⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1820
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        87⤵
        Creates scheduled task(s)
        
        PID:3084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kxO1ZK4XjUgk.bat" "
        87⤵
        
        PID:2176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        88⤵
        
        PID:3472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        88⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        88⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        89⤵
        
        PID:2336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bACR6LqVGJNG.bat" "
        89⤵
        
        PID:2120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        90⤵
        
        PID:3932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        90⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        90⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3656
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        91⤵
        Creates scheduled task(s)
        
        PID:2096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tjCnyjZ1IYPK.bat" "
        91⤵
        
        PID:1396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        92⤵
        
        PID:2752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        92⤵
        Runs ping.exe
        
        PID:4508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        92⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2956
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        93⤵
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwZee1VcMIEA.bat" "
        93⤵
        
        PID:276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        94⤵
        
        PID:2500
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        94⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        94⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:232
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        95⤵
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOO5VGtt4hzX.bat" "
        95⤵
        
        PID:2236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        96⤵
        
        PID:4136
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        96⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        96⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        97⤵
        
        PID:4884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t62m0fjkUIfv.bat" "
        97⤵
        
        PID:1532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        98⤵
        
        PID:2940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        98⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        98⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3680
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        99⤵
        Creates scheduled task(s)
        
        PID:4516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J26rFl5pmtqc.bat" "
        99⤵
        
        PID:3260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        100⤵
        
        PID:3760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        100⤵
        Runs ping.exe
        
        PID:3976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        100⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3520
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        101⤵
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RfjAwDUF3sij.bat" "
        101⤵
        
        PID:2036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        102⤵
        
        PID:1688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        102⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        102⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2128
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        103⤵
        
        PID:4512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N23qllG7uS2P.bat" "
        103⤵
        
        PID:4556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        104⤵
        
        PID:3980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        104⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        104⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4056
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        105⤵
        Creates scheduled task(s)
        
        PID:3932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NE1wsEXSbS3n.bat" "
        105⤵
        
        PID:492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        106⤵
        
        PID:3596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        106⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        106⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4224
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        107⤵
        
        PID:4076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G8kk92ovqxUw.bat" "
        107⤵
        
        PID:1396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        108⤵
        
        PID:4128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        108⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        108⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2676
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        109⤵
        
        PID:3504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgUIL8i01Tn1.bat" "
        109⤵
        
        PID:2248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        110⤵
        
        PID:2380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        110⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        110⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3216
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        111⤵
        Creates scheduled task(s)
        
        PID:3236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SO66aHNDYqFc.bat" "
        111⤵
        
        PID:3400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        112⤵
        
        PID:3956
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        112⤵
        Runs ping.exe
        
        PID:1020
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        112⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4112
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        113⤵
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\70PRqkJ4fyEC.bat" "
        113⤵
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        114⤵
        
        PID:2796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        114⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        114⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3544
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        115⤵
        Creates scheduled task(s)
        
        PID:2600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zvGRqeaNlH8F.bat" "
        115⤵
        
        PID:2668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        116⤵
        
        PID:2296
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        116⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        116⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3960
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        117⤵
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0BRqjuluHcQy.bat" "
        117⤵
        
        PID:1204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        118⤵
        
        PID:2616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        118⤵
        Runs ping.exe
        
        PID:928
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        118⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2080
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        119⤵
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KpbEDHK3FrLu.bat" "
        119⤵
        
        PID:2336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        120⤵
        
        PID:2176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        120⤵
        Runs ping.exe
        
        PID:1476
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        120⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2928
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        121⤵
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XDWLiblg9kfx.bat" "
        121⤵
        
        PID:4888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        122⤵
        
        PID:1488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        122⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        122⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1452
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        123⤵
        
        PID:4508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xBkUhDzlvOb7.bat" "
        123⤵
        
        PID:4204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        124⤵
        
        PID:4388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        124⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        124⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:876
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        125⤵
        
        PID:5028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MiAnHxlWJfUT.bat" "
        125⤵
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        126⤵
        
        PID:476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        126⤵
        Runs ping.exe
        
        PID:5048
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        126⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1800
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        127⤵
        
        PID:3220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mp5FFm9RBdca.bat" "
        127⤵
        
        PID:1020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        128⤵
        
        PID:3660
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        128⤵
        Runs ping.exe
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        128⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4544
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        129⤵
        
        PID:1532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xrdWVPWoLRDF.bat" "
        129⤵
        
        PID:1936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        130⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        130⤵
        Runs ping.exe
        
        PID:3688
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        130⤵
        
        PID:2640
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        131⤵
        Creates scheduled task(s)
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o8VShtEjRJn8.bat" "
        131⤵
        
        PID:2580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        132⤵
        
        PID:2324
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        132⤵
        Runs ping.exe
        
        PID:3152
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        132⤵
        
        PID:4848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        133⤵
        Creates scheduled task(s)
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tz7Mjqi2OQy1.bat" "
        133⤵
        
        PID:4512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        134⤵
        
        PID:4672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        134⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        134⤵
        
        PID:2344
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        135⤵
        Creates scheduled task(s)
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUYf0JBOU8Ju.bat" "
        135⤵
        
        PID:720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        136⤵
        
        PID:4416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        136⤵
        Runs ping.exe
        
        PID:1644
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        136⤵
        
        PID:2916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        137⤵
        Creates scheduled task(s)
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nEZluLamKLSx.bat" "
        137⤵
        
        PID:3184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        138⤵
        
        PID:4520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        138⤵
        Runs ping.exe
        
        PID:4660
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        138⤵
        
        PID:1880
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        139⤵
        
        PID:2024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xp2ivy2lNOd6.bat" "
        139⤵
        
        PID:488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        140⤵
        
        PID:2000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        140⤵
        Runs ping.exe
        
        PID:5108
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        140⤵
        
        PID:2212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        141⤵
        
        PID:3316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n4HxkFSZJgld.bat" "
        141⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        142⤵
        
        PID:4648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        142⤵
        Runs ping.exe
        
        PID:1000
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        142⤵
        
        PID:1612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        143⤵
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FW0cCIUiPXQ2.bat" "
        143⤵
        
        PID:2936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        144⤵
        
        PID:2796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        144⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        144⤵
        
        PID:1460
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        145⤵
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VZjYciCVfqEI.bat" "
        145⤵
        
        PID:1912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        146⤵
        
        PID:4616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        146⤵
        Runs ping.exe
        
        PID:1444
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        146⤵
        
        PID:1688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        147⤵
        
        PID:3168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m83opeigWC91.bat" "
        147⤵
        
        PID:4568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        148⤵
        
        PID:4868
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        148⤵
        Runs ping.exe
        
        PID:1928
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        148⤵
        
        PID:4504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        149⤵
        
        PID:784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dJVWqN0NMoxQ.bat" "
        149⤵
        
        PID:2252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        150⤵
        
        PID:2716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        150⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        150⤵
        
        PID:3428
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        151⤵
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k8ocMlibLnTq.bat" "
        151⤵
        
        PID:492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        152⤵
        
        PID:4748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        152⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        152⤵
        
        PID:3700
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        153⤵
        
        PID:2276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HdKdWS9ZAv3z.bat" "
        153⤵
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        154⤵
        
        PID:808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        154⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        154⤵
        
        PID:980
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        155⤵
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xyOpJ1hHOopI.bat" "
        155⤵
        
        PID:3612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        156⤵
        
        PID:1792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        156⤵
        Runs ping.exe
        
        PID:4980
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        156⤵
        
        PID:1308
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        157⤵
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PfxL8GB20bcc.bat" "
        157⤵
        
        PID:1588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        158⤵
        
        PID:1572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        158⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        158⤵
        
        PID:3248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        159⤵
        
        PID:3992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oYMv52ZScklF.bat" "
        159⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        160⤵
        
        PID:4616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        160⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        160⤵
        
        PID:2968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        161⤵
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqfBxzyZnaku.bat" "
        161⤵
        
        PID:2580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        162⤵
        
        PID:1028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        162⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        162⤵
        
        PID:4548
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        163⤵
        Creates scheduled task(s)
        
        PID:4832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hub3j8KqgwuA.bat" "
        163⤵
        
        PID:1200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        164⤵
        
        PID:1524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        164⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        164⤵
        
        PID:4916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        165⤵
        
        PID:2096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7BGzGLjh5MY9.bat" "
        165⤵
        
        PID:4748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        166⤵
        
        PID:4876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        166⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        166⤵
        
        PID:240
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        167⤵
        
        PID:1004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XV70aJMlbhGS.bat" "
        167⤵
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        168⤵
        
        PID:5028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        168⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        168⤵
        
        PID:3956
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        169⤵
        
        PID:3024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWFAZqMb1X3p.bat" "
        169⤵
        
        PID:788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        170⤵
        
        PID:696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        170⤵
        Runs ping.exe
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        170⤵
        
        PID:3180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        171⤵
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6rmP8NTju2LP.bat" "
        171⤵
        
        PID:2672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        172⤵
        
        PID:2796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        172⤵
        Runs ping.exe
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        172⤵
        
        PID:2228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        173⤵
        Creates scheduled task(s)
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jjODrhVTNCBQ.bat" "
        173⤵
        
        PID:1992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        174⤵
        
        PID:4840
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        174⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        174⤵
        
        PID:2616
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        175⤵
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U0I1kqLQh49T.bat" "
        175⤵
        
        PID:4568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        176⤵
        
        PID:352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        176⤵
        Runs ping.exe
        
        PID:4972
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        176⤵
        
        PID:2388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        177⤵
        
        PID:1160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RxIqkgYVbT9h.bat" "
        177⤵
        
        PID:956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        178⤵
        
        PID:4416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        178⤵
        Runs ping.exe
        
        PID:656
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        178⤵
        
        PID:5024
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        179⤵
        Creates scheduled task(s)
        
        PID:1528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mpGiqR8BP0QP.bat" "
        179⤵
        
        PID:200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        180⤵
        
        PID:3436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        180⤵
        Runs ping.exe
        
        PID:3548
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        180⤵
        
        PID:3736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        181⤵
        Creates scheduled task(s)
        
        PID:3432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6jUsRAdZTdiV.bat" "
        181⤵
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        182⤵
        
        PID:4780
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        182⤵
        Runs ping.exe
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        182⤵
        
        PID:5108
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        183⤵
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Yg16iJST0ot1.bat" "
        183⤵
        
        PID:3256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        184⤵
        
        PID:652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        184⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        184⤵
        
        PID:2016
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        185⤵
        
        PID:688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VbZKZQ38U2cl.bat" "
        185⤵
        
        PID:3600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        186⤵
        
        PID:4468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        186⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        186⤵
        
        PID:1324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        187⤵
        
        PID:3084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E79oSgfcWDKT.bat" "
        187⤵
        
        PID:3648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        188⤵
        
        PID:1092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        188⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        188⤵
        
        PID:4312
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        189⤵
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kMQzjZjwNQZ2.bat" "
        189⤵
        
        PID:4836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        190⤵
        
        PID:4904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        190⤵
        Runs ping.exe
        
        PID:3404
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        190⤵
        
        PID:5000
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        191⤵
        Creates scheduled task(s)
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wbI2KIb1odDE.bat" "
        191⤵
        
        PID:1476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        192⤵
        
        PID:4876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        192⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        192⤵
        
        PID:2096
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        193⤵
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mkxDImQ6RP23.bat" "
        193⤵
        
        PID:2276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        194⤵
        
        PID:3644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        194⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        194⤵
        
        PID:3968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        195⤵
        Creates scheduled task(s)
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gBZXiYEGUPWQ.bat" "
        195⤵
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        196⤵
        
        PID:328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        196⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        196⤵
        
        PID:3812
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        197⤵
        
        PID:3264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CVXREwmyPSTa.bat" "
        197⤵
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        198⤵
        
        PID:3260
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        198⤵
        Runs ping.exe
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        198⤵
        
        PID:3064
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        199⤵
        Creates scheduled task(s)
        
        PID:572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t9eVD6euJ5OJ.bat" "
        199⤵
        
        PID:3992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        200⤵
        
        PID:4872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        200⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        200⤵
        
        PID:1180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        201⤵
        Creates scheduled task(s)
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\afz0Fuw5kBio.bat" "
        201⤵
        
        PID:2868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        202⤵
        
        PID:784
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        202⤵
        Runs ping.exe
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        202⤵
        
        PID:4268
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        203⤵
        Creates scheduled task(s)
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xmWnIgjVRb1R.bat" "
        203⤵
        
        PID:656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        204⤵
        
        PID:4044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        204⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        204⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        205⤵
        
        PID:1528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pZciu6UdC8F1.bat" "
        205⤵
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        206⤵
        
        PID:3436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        206⤵
        Runs ping.exe
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        206⤵
        
        PID:3564
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        207⤵
        Creates scheduled task(s)
        
        PID:928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6E2U1OWHsQsq.bat" "
        207⤵
        
        PID:4248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        208⤵
        
        PID:1196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        208⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        208⤵
        
        PID:1572
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        209⤵
        
        PID:1560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dBLkT0VFel6P.bat" "
        209⤵
        
        PID:1312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        210⤵
        
        PID:788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        210⤵
        Runs ping.exe
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        210⤵
        
        PID:3600
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        211⤵
        Creates scheduled task(s)
        
        PID:2720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4PQyKbh3SJyH.bat" "
        211⤵
        
        PID:3748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        212⤵
        
        PID:3992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        212⤵
        Runs ping.exe
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        212⤵
        
        PID:3172
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        213⤵
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tJvessykVY2I.bat" "
        213⤵
        
        PID:4572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        214⤵
        
        PID:3524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        214⤵
        Runs ping.exe
        
        PID:4968
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        214⤵
        
        PID:2524
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        215⤵
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YN123hDTMBwU.bat" "
        215⤵
        
        PID:3832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        216⤵
        
        PID:1604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        216⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        216⤵
        
        PID:4412
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        217⤵
        Creates scheduled task(s)
        
        PID:3944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\coQkTtGpudIY.bat" "
        217⤵
        
        PID:2288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        218⤵
        
        PID:2340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        218⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        218⤵
        
        PID:1396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        219⤵
        Creates scheduled task(s)
        
        PID:900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h3faOVP9K5zL.bat" "
        219⤵
        
        PID:3156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        220⤵
        
        PID:4704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        220⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        220⤵
        
        PID:3196
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        221⤵
        
        PID:1000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GZ6NDEO0ONVc.bat" "
        221⤵
        
        PID:2208
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        222⤵
        
        PID:3400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        222⤵
        Runs ping.exe
        
        PID:2460
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        222⤵
        
        PID:3992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        223⤵
        
        PID:1532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DmyC9rPObl2Z.bat" "
        223⤵
        
        PID:3748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        224⤵
        
        PID:784
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        224⤵
        Runs ping.exe
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        224⤵
        
        PID:2324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        225⤵
        Creates scheduled task(s)
        
        PID:3776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f8KECq5tpA1u.bat" "
        225⤵
        
        PID:1564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        226⤵
        
        PID:4984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        226⤵
        Runs ping.exe
        
        PID:1604
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        226⤵
        
        PID:3972
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        227⤵
        Creates scheduled task(s)
        
        PID:432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G4B1PM3GQxRP.bat" "
        227⤵
        
        PID:2772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        228⤵
        
        PID:3944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        228⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        228⤵
        
        PID:2340
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        229⤵
        
        PID:3504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ae19hVKs5VzF.bat" "
        229⤵
        
        PID:2348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        230⤵
        
        PID:3024
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        230⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        230⤵
        
        PID:1240
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        231⤵
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a9LEXC3ytY0t.bat" "
        231⤵
        
        PID:756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        232⤵
        
        PID:1620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        232⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        232⤵
        
        PID:4696
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        233⤵
        Creates scheduled task(s)
        
        PID:4116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8q55EdPYoR07.bat" "
        233⤵
        
        PID:772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        234⤵
        
        PID:2412
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        234⤵
        Runs ping.exe
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        234⤵
        
        PID:4340
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        235⤵
        
        PID:572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SWupukej1TFa.bat" "
        235⤵
        
        PID:2456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        236⤵
        
        PID:352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        236⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        236⤵
        
        PID:4760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        237⤵
        Creates scheduled task(s)
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HSrPsSyIKMPO.bat" "
        237⤵
        
        PID:956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        238⤵
        
        PID:2336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        238⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        238⤵
        
        PID:2304
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        239⤵
        Creates scheduled task(s)
        
        PID:3244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOYSSLv9xeEK.bat" "
        239⤵
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        240⤵
        
        PID:2772
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        240⤵
        Runs ping.exe
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        240⤵
        
        PID:3120
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        241⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S5YKi2ubWjgE.bat" "
        241⤵
        
        PID:1088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        242⤵
        
        PID:3916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        242⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        242⤵
        
        PID:4960
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        243⤵
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ceEtuBKAM5AL.bat" "
        243⤵
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        244⤵
        
        PID:3388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        244⤵
        Runs ping.exe
        
        PID:4140
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        244⤵
        
        PID:4872
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        245⤵
        Creates scheduled task(s)
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4iCM0ZakOKW3.bat" "
        245⤵
        
        PID:3760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        246⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        246⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        246⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        247⤵
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ynz70SHT8pU4.bat" "
        247⤵
        
        PID:3648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        248⤵
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        248⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        248⤵
        
        PID:868
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        249⤵
        
        PID:3776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mMRBKm5HoUkp.bat" "
        249⤵
        
        PID:1604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        250⤵
        
        PID:1656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        250⤵
        Runs ping.exe
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        250⤵
        
        PID:568
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        251⤵
        Creates scheduled task(s)
        
        PID:1004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YfeZVENwm3uO.bat" "
        251⤵
        
        PID:3316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        252⤵
        
        PID:3024
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        252⤵
        Runs ping.exe
        
        PID:3860
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        252⤵
        
        PID:3464
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        253⤵
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EDahqpRm1G1Q.bat" "
        253⤵
        
        PID:2652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        254⤵
        
        PID:4648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        254⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        254⤵
        
        PID:1280
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        255⤵
        
        PID:3576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FgsNdl0A88zR.bat" "
        255⤵
        
        PID:2768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        256⤵
        
        PID:4516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        256⤵
        Runs ping.exe
        
        PID:476
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        256⤵
        
        PID:3780
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        257⤵
        Creates scheduled task(s)
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XvDI1wMeraFe.bat" "
        257⤵
        
        PID:3324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        258⤵
        
        PID:1928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        258⤵
        Runs ping.exe
        
        PID:4592
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        258⤵
        
        PID:4876
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        259⤵
        Creates scheduled task(s)
        
        PID:2752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E6crFz1PYh7K.bat" "
        259⤵
        
        PID:3040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        260⤵
        
        PID:2576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        260⤵
        Runs ping.exe
        
        PID:1472
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        260⤵
        
        PID:4220
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        261⤵
        Creates scheduled task(s)
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GZRxop08TNTs.bat" "
        261⤵
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        262⤵
        
        PID:3804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        262⤵
        Runs ping.exe
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        262⤵
        
        PID:3232
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        263⤵
        
        PID:1480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LcFLt52daBXJ.bat" "
        263⤵
        
        PID:2444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        264⤵
        
        PID:4976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        264⤵
        Runs ping.exe
        
        PID:4352
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        264⤵
        
        PID:1924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        265⤵
        Creates scheduled task(s)
        
        PID:2896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rifHprmAlKjs.bat" "
        265⤵
        
        PID:3556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        266⤵
        
        PID:4116
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        266⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        266⤵
        
        PID:1336
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        267⤵
        Creates scheduled task(s)
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3Zm9zUQUQJYb.bat" "
        267⤵
        
        PID:3748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        268⤵
        
        PID:572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        268⤵
        Runs ping.exe
        
        PID:3472
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        268⤵
        
        PID:1012
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        269⤵
        
        PID:4672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Vi4dMIwlT3JO.bat" "
        269⤵
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        270⤵
        
        PID:3020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        270⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        270⤵
        
        PID:3596
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        271⤵
        Creates scheduled task(s)
        
        PID:1564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7W1j0eXKfhkY.bat" "
        271⤵
        
        PID:1528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        272⤵
        
        PID:4128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        272⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        272⤵
        
        PID:3024
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        273⤵
        Creates scheduled task(s)
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y88DgOkrcWTl.bat" "
        273⤵
        
        PID:904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        274⤵
        
        PID:2980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        274⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        274⤵
        
        PID:3688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        275⤵
        Creates scheduled task(s)
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hPVf5rqt55ow.bat" "
        275⤵
        
        PID:3432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        276⤵
        
        PID:4468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        276⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        276⤵
        
        PID:760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        277⤵
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ux6MSvskfLkQ.bat" "
        277⤵
        
        PID:3904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        278⤵
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        278⤵
        Runs ping.exe
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        278⤵
        
        PID:3748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        279⤵
        Creates scheduled task(s)
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5sAM1qsTYc2z.bat" "
        279⤵
        
        PID:2252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        280⤵
        
        PID:3404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        280⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        280⤵
        
        PID:1668
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        281⤵
        
        PID:836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISMjAu31N2a1.bat" "
        281⤵
        
        PID:344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        282⤵
        
        PID:4748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        282⤵
        Runs ping.exe
        
        PID:432
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        282⤵
        
        PID:2720
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        283⤵
        Creates scheduled task(s)
        
        PID:3860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\slLiBQFOF7nV.bat" "
        283⤵
        
        PID:3548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        284⤵
        
        PID:4576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        284⤵
        Runs ping.exe
        
        PID:1196
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        284⤵
        
        PID:2312
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        285⤵
        Creates scheduled task(s)
        
        PID:2348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iXAtxCKz0CrF.bat" "
        285⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        286⤵
        
        PID:3416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        286⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        286⤵
        
        PID:4444
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        287⤵
        Creates scheduled task(s)
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4Hzb4vBv8aNf.bat" "
        287⤵
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        288⤵
        
        PID:4840
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        288⤵
        Runs ping.exe
        
        PID:3228
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        288⤵
        
        PID:4512
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        289⤵
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I0SUGviB3HNN.bat" "
        289⤵
        
        PID:3404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        290⤵
        
        PID:2512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        290⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        290⤵
        
        PID:2012
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        291⤵
        
        PID:4128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\893gRNqGdquz.bat" "
        291⤵
        
        PID:3244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        292⤵
        
        PID:2920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        292⤵
        Runs ping.exe
        
        PID:344
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        292⤵
        
        PID:1004
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        293⤵
        
        PID:3860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\prvSAhl89wOU.bat" "
        293⤵
        
        PID:3516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        294⤵
        
        PID:3704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        294⤵
        
        PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778
MD5 15eab799098760706ed95d314e75449d
SHA1 273fb07e40148d5c267ca53f958c5075d24c4444
SHA512 50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c
MD5 SHA1 SHA512

Submit Download

06AREvMDpBvJ.bat

Path C:\Users\Admin\AppData\Local\Temp\06AREvMDpBvJ.bat
Size 207B
SHA256 708e6880851f7469b2636c16d9240fb9baa2ee16c6312c2157019001b050994a
MD5 1697e87ab0488a66027762e1f7b8c4ff
SHA1 f83c7c88fbede6dbaa49e7bd98eec34e4d3a2741
SHA512 1388b24b4d156cd5e2356920d957e8a269bbbb4a47105397febfc09bee513289bf63db46df84eef86068784249b72d2c71f78cee3cd6f9f64c680d30de5b7e1c
MD5 SHA1 SHA512

Submit Download

0pa3gzdzoAxn.bat

Path C:\Users\Admin\AppData\Local\Temp\0pa3gzdzoAxn.bat
Size 207B
SHA256 70fcdcc0b234f6a4b585ebf8e8a2cf8c14a42cfa88b5aa07ae83926aa30a1615
MD5 7a8b68d9bcacbdc3dd02209a74823901
SHA1 fc4816d0e7efdb2df4f768e3948650e66ddf905c
SHA512 3ae201078fd99c66f7385a472cb453d16f5ba831263d57fb05b3d686ccaa2e94638d3c376a3dc3a31c3378eb4da24c3b507d82b2076d7fcfc0b81b9610c48bbf
MD5 SHA1 SHA512

Submit Download

4mUrhO9KqmU2.bat

Path C:\Users\Admin\AppData\Local\Temp\4mUrhO9KqmU2.bat
Size 207B
SHA256 93f39e888c41999182f052f59776a3c3b35c084f5782932d4477dc66cdf79c9c
MD5 41ab2b5e3efaf0f5d15070e2dd00665a
SHA1 786d212f681402862a8521032f4a06f4eb7157d5
SHA512 517fe05ee58924a98a5761a5f52551def818e269037a13b63b07934e372223e58bf7ba09bdb0f9b7931f9c4d0ff5fe9f74be59b51d901ea8caf9ec0b722b46af
MD5 SHA1 SHA512

Submit Download

6S1p2NkrEn92.bat

Path C:\Users\Admin\AppData\Local\Temp\6S1p2NkrEn92.bat
Size 207B
SHA256 c60c45434f78c39a6b53cc02eb09ca3d951c70cd3e94f7d56878c16b782648fd
MD5 73e7e0938758f289fe015724b1a09c61
SHA1 de2b685af4f63483ab448a169097bf0d4155bb65
SHA512 09cd5128b34c22c8488282d591f5f2c01513b91f10b6ac4e5297995ea6d742ee699b82786a0d0827432e3eb189b5e5722e050d78efbdee7ec325ab4ed5865435
MD5 SHA1 SHA512

Submit Download

8rN2rHMJyNCy.bat

Path C:\Users\Admin\AppData\Local\Temp\8rN2rHMJyNCy.bat
Size 207B
SHA256 837216b308405a63667938ed3e1536d94d38d2a6d6eac4f6e5d64486e04f9c4f
MD5 0a426acef269a842311a87a9ef55304e
SHA1 83b0d754bc094876021f000b671dca781725bcec
SHA512 b5396ba39b325a2091b12a8b61d75204e8bb6111e4e88a16df4061a5864ab07eb0ca6969d6d53e1c6953d28bf29114dd9743066421710757ec59f0517f7874e1
MD5 SHA1 SHA512

Submit Download

9nXOBA5qn6Ru.bat

Path C:\Users\Admin\AppData\Local\Temp\9nXOBA5qn6Ru.bat
Size 207B
SHA256 2a51526cb4b21583e0a767ec5ce4142f0f74c5a1d76c9a9e759da07c436bd239
MD5 341f80da5cf706e3476502946880a66a
SHA1 321a72c7b9fa63fef03e9092c673eb842b2968e8
SHA512 9095c432013a0acc167181d2b839eb5f3ececcb99f131c4a0f9e248bd0c8530dc32d83d000b02a07932b4b5c190b958a70b1ba8432d6e863212260e0df7011a5
MD5 SHA1 SHA512

Submit Download

A7dTJEAEdoUl.bat

Path C:\Users\Admin\AppData\Local\Temp\A7dTJEAEdoUl.bat
Size 207B
SHA256 1594ae507138d25138e22fc6a0f1931cc094caf23391c902e1e91eaa05800b25
MD5 5f4ad2318d637c898bb5bb1a78aef52e
SHA1 59b2749e4fab1745a990806bc1394ec7c72e4938
SHA512 c7fbd164b379855d6500063f0f7d747b940c3b5e95286d8be297427366196ffa72c79d1fbbc9b40aeadeb3ec83e4f17461d8c1f8fcd53acc3713feb6cc913754
MD5 SHA1 SHA512

Submit Download

APQOGQeqkQlt.bat

Path C:\Users\Admin\AppData\Local\Temp\APQOGQeqkQlt.bat
Size 207B
SHA256 dba07ae061a5653b58518d7038da59da0c4cf4987705ce2ad8f5806e9a976dd4
MD5 03f11a1cfc053edc6a7e3a7d929f8aec
SHA1 58d25278fdd1ad2da161db044b1d316a42f497af
SHA512 648a2411b61a4c92f947726b1173e08e51f811572fe1087bb1064b99ea4d51b159c88b52455081a2ab2757acc947f2c911285ebd88fafcf47d57592b65134bae
MD5 SHA1 SHA512

Submit Download

BAkBRPuvCmo4.bat

Path C:\Users\Admin\AppData\Local\Temp\BAkBRPuvCmo4.bat
Size 207B
SHA256 176fc43035e89a57752df1aae0457a0da6aaf5072b3cc964973e227f40e279ba
MD5 86d34b61224b5dc34e6dfb44298d8e07
SHA1 111e1d82844840f3cc73b349377a282406e6e458
SHA512 3f69eaae406ae6bacad01dd2e61b11a11c33da6ac055fa5e93039385ab09de18a56f1430e3ad46833d313e70b69284e4ade6b3244ab9de05f96aee4fbbe8a4c7
MD5 SHA1 SHA512

Submit Download

BJpfVUp0xDVY.bat

Path C:\Users\Admin\AppData\Local\Temp\BJpfVUp0xDVY.bat
Size 207B
SHA256 d88775765d8498926d238408abac41f9b13013068536a41481a7d6ea58607de6
MD5 f5760a5c0d65640c1dced3209eaac11b
SHA1 f2352c966e8b8127a3628c029a0abd41f187a690
SHA512 dd170d46c1c35af39e6853166b9e699086e290d7840d1afbbefd6856c60314c134d4ddb1a39d71b9c6fd1daf985062dbe2ff4ffd406ab94e50a0636f869315fe
MD5 SHA1 SHA512

Submit Download

CZKgwE8tKFgU.bat

Path C:\Users\Admin\AppData\Local\Temp\CZKgwE8tKFgU.bat
Size 207B
SHA256 fd52c15b8e9a28db795ab97f307765ea6bcb021e7293aea97ba26b73287a5269
MD5 924d954a574bf140ff76101166a5343d
SHA1 1c3cc49163eebb7ab0b9f7036a1198fabdd5f6bb
SHA512 3e35a3b51b38560322bbf0b4cf11fcaeb8ec1278fbcc11bf7a6876481ec2401ef3c8b7139eb172dff339808b16fcac7a001846d4ac954a85aae49e6d75212a54
MD5 SHA1 SHA512

Submit Download

DnVNLfD2wFdb.bat

Path C:\Users\Admin\AppData\Local\Temp\DnVNLfD2wFdb.bat
Size 207B
SHA256 05119205d6c349e7e65d926fc368ebe7418d8883045bced9349ce4058e24e01c
MD5 5fb71042195f658fbdae0360f6b73908
SHA1 c32c851593693a7c5160956c2d3721b98453a1fa
SHA512 5f19680f88e2b5d0ff75a8da92c3e9eea79fa0003a3fedda831d9ba0a2110ab04be94293afd0991289a040ae32eef2a63817b91e9b6103ea420211ebbb90e69f
MD5 SHA1 SHA512

Submit Download

ElhD2exBbFvd.bat

Path C:\Users\Admin\AppData\Local\Temp\ElhD2exBbFvd.bat
Size 207B
SHA256 99d635a229bb53d0a4316a97fdb2b79792a611d4cbf950d9398b80713e6ec768
MD5 0ddf9bbbd0056eb2c30c59abcfdda075
SHA1 b97734c057a65ff231988756e77571263e925290
SHA512 d25e2929057aa48a47c2aa3434345352c9ea4906f6b7a745a0fde688f5b649dadb97b68c15a6b651a81862dcfcaed8b159e3ebbf76ac9bc4350db19558651412
MD5 SHA1 SHA512

Submit Download

IIinSDjruKAf.bat

Path C:\Users\Admin\AppData\Local\Temp\IIinSDjruKAf.bat
Size 207B
SHA256 8c09c72234560e488b96e103fc04dd5e5b2f0dec54516aaa12a5d14719b31bde
MD5 b3d91a07c9ef496dc8898787a583d36c
SHA1 ebd571ff8d1d7284c60afc5e48e190d2c4a42d3b
SHA512 fe5cea0f9016c18a3180694a0e5f38b8c8a619e374281c142b58489d1ea603b340a768d9b550d1859bded3ea7e74a3dbf212b97404e12164a214109f8cac0f47
MD5 SHA1 SHA512

Submit Download

LH820fI1YCI0.bat

Path C:\Users\Admin\AppData\Local\Temp\LH820fI1YCI0.bat
Size 207B
SHA256 78bb99911fd30e1584a7e02ab284096d65be31dcaa333da51df9618896327305
MD5 56091e8fa677746688a3978b4abc84af
SHA1 4765446627ef87b32bd03b38b89eaf07d363e9e7
SHA512 09e51f22e75cb64f175675ff8e5f6abf3eba19d72c211a8b5ca14d841fb0294415ae0e87e5f68c6563f82fa3c35fa0412c15951bb57debf26722484e61d7ea1a
MD5 SHA1 SHA512

Submit Download

LNMTqPetoQPd.bat

Path C:\Users\Admin\AppData\Local\Temp\LNMTqPetoQPd.bat
Size 207B
SHA256 409f21009b42d0edc8909bbe470b453266802d94d9a4cd5be07ec5226e525933
MD5 529246b8efa68039dd46f34d004c1e7d
SHA1 8a6748c5265028ff743a18c097a52f51cfdb450a
SHA512 9a6d7734b0412272b37f36b714204bbdeabc9d4fd700640c505971632bcabbd08c13af593b36cd0332e7b25850536bc1a92eda25668de04273677c284490f95a
MD5 SHA1 SHA512

Submit Download

LNT4s01VPvjn.bat

Path C:\Users\Admin\AppData\Local\Temp\LNT4s01VPvjn.bat
Size 207B
SHA256 802e31f78a5898fc4357f3cfc7f9d476f6478499a7fa4dd017e6a60bb52ba915
MD5 ecf8619a4313a56910952b8f46ae624d
SHA1 6067cadfacca6ae39d5f7918a0842c81b72e106c
SHA512 9b943635e85d5761f6dbf30e02219ca788da11f42bfa3aa3adc77e17a8f5965b07395c9567806d0452b9f2afea211d48ebdb04c3756e0b9ef423d3631be35eea
MD5 SHA1 SHA512

Submit Download

LjrlIKs6rGvs.bat

Path C:\Users\Admin\AppData\Local\Temp\LjrlIKs6rGvs.bat
Size 207B
SHA256 85dd5864c446bb707020c9715ae16f56f16c28b8776795302caae033c9fb2461
MD5 88591d6d31f6d72a74ff5ee8ca3ba479
SHA1 3a000926bb84fb97259ab1b905a6211d852c8877
SHA512 ef82713bfc6c7702bf1628bb8cfa3c2549ba0c4d48dafd9d7fa8f66cc6514d538d7af62e2e3b25a89ef1e9d0f67bc899c8f87b1736e8b1aa9abf3698464a800a
MD5 SHA1 SHA512

Submit Download

OBcqqA4Ix0sR.bat

Path C:\Users\Admin\AppData\Local\Temp\OBcqqA4Ix0sR.bat
Size 207B
SHA256 fbddd2b0f5779c5cd2e2b20de8f5a752325894a8779c32e23c22a13d9d4ab147
MD5 e7566c198221609682db86d8078e94ea
SHA1 2ef0898281831cc5de5d4149935be4f9e9ffdc66
SHA512 74288cd23cceb0b23ee412ad70872a249735125189fdb02f43228db8479c392a39cf7227cc5b4226afa7d62d6b38fe8ba4d2f4565e2335260fc309c2ebbe603f
MD5 SHA1 SHA512

Submit Download

RntT1bEBvKY2.bat

Path C:\Users\Admin\AppData\Local\Temp\RntT1bEBvKY2.bat
Size 207B
SHA256 647e3675a8b981c6f49b4d95950b82cf35bda6505dd547e7f9a4716762bb4f80
MD5 fdad801ce8ef35cbfbaba5e51305c517
SHA1 2dc80c873a95f15a8823d93c9f168472cbdff06f
SHA512 a5b8c9aa751117e5341ce952718e05ef9b1c4bc600746abaca3679e9f6a905bbdb0364241a31cff58248e4472b177642552cf2983b54baa2bc71b995ec1a97aa
MD5 SHA1 SHA512

Submit Download

d70hj6R3P8YY.bat

Path C:\Users\Admin\AppData\Local\Temp\d70hj6R3P8YY.bat
Size 207B
SHA256 4a82df425d42d58dff8062eda7e9abaf85bad986f7581116d6520b85b20f97a3
MD5 b1160cb1e312b6535f75e900619e5709
SHA1 e46ca4965234c600767638dc7e5627bd83492414
SHA512 35dbfc1c9ec08f031627bb29bd8012f927c6ea4009bbe13192f2c3651c331eb16e3378d907fe29e273f426780db8b40e7cedbcd2d81b27d3e21dfc2bd65ec93b
MD5 SHA1 SHA512

Submit Download

gM9ZfPxnMa68.bat

Path C:\Users\Admin\AppData\Local\Temp\gM9ZfPxnMa68.bat
Size 207B
SHA256 e43741bdcaaaa420d9d8fd27ab2be6e2c30d737ea8855f345d61271b88e9776e
MD5 ad7487117b7f05bd2de98762d8a29ab9
SHA1 4670ecf9ae997135199d400d279d0b30542283fc
SHA512 1ca2385df17fa66ac8be322a53d4bba6b2e003471ac8fc9e4c103a9546c8510e40631670d726a119c634788be59cfc26df9cebf533cac2ce4b89c4bf5e913a9e
MD5 SHA1 SHA512

Submit Download

j4Z3QG29WfBK.bat

Path C:\Users\Admin\AppData\Local\Temp\j4Z3QG29WfBK.bat
Size 207B
SHA256 cfe535de43c500103780befa3913a9c7e94e13a55b111237f7fded5ce67bc234
MD5 c58eea3d2654374d32d9ed7686a53914
SHA1 85f747433b779d3b9dc1b0fcd4b40e1bed88063c
SHA512 189e1a0d711a585bc4123f6d97e47966ee5242a034d73e8759dce4b38a9908c3297856d30c036f7842e640b9e3f19b8742619b9c1e7f3f1a3aed8b85efd6378d
MD5 SHA1 SHA512

Submit Download

jmZGMCoUu1LQ.bat

Path C:\Users\Admin\AppData\Local\Temp\jmZGMCoUu1LQ.bat
Size 207B
SHA256 62a049beab12b8c529edabb8259ed55f9665a4a851cb76c0f15ef91f066a0cfc
MD5 8fe0e19f971ff3a2943d3e03a4940362
SHA1 a7685b66789c6e49b739363aeb22a8705016af0c
SHA512 4c443b38f802fdd53399ea5e9787ee245d4b0bea772239e08b0c72db56fe9cff5ccc2852ecb64f9714f3e9e2ddb7c69edc1e9d919509f055336407e79bc99c91
MD5 SHA1 SHA512

Submit Download

mOj2IucTTutO.bat

Path C:\Users\Admin\AppData\Local\Temp\mOj2IucTTutO.bat
Size 207B
SHA256 2f24c66dfb6041f7767fe7796f52365e3ea3c6565a1a8cdf9bf29229995b716b
MD5 468dff64ce4ad6e2f96a4fdecc26f316
SHA1 a22ea1f016ced4bd22aa7f567f307c304991b29d
SHA512 889d8348c26c25bf2ca47732a8266abf5c95072a9347672b5e73836bb7ca91201b074b42bf6028bb644db5ff938201f7862c32af57bda2673083ef431319b4f9
MD5 SHA1 SHA512

Submit Download

n7aSt7rnPBIT.bat

Path C:\Users\Admin\AppData\Local\Temp\n7aSt7rnPBIT.bat
Size 207B
SHA256 2c4c89d503eea1af02d6d95ac8e2abf31a90f4d52e074734be1e7c0c8598fb9f
MD5 75dee62b0bc871cbdb3bd1af3a6c795a
SHA1 e12feed93117ca2574e4428a9e99ae5716df65cf
SHA512 986c2d01d2c89946d218fd17d547a4db01b19b9e5ea3bf5a6197980fd95344fd9f6ec4b5a2a78992b8333347e726262ae5b9dbdaa541169bd7040972d3ca020d
MD5 SHA1 SHA512

Submit Download

nFIcwG2MNtL9.bat

Path C:\Users\Admin\AppData\Local\Temp\nFIcwG2MNtL9.bat
Size 207B
SHA256 6c601abc6900edb48c786dac79c19315b963a1a6150c754fd93bd9216d1ea634
MD5 3b2e36dfd288ff8db6f60aac868dc87f
SHA1 a8841900c4fe406cffb29924d2f82fc90c0d0df8
SHA512 0beb2185cf892bffad44ee5a2f4a4e845ac165115ee0100bb5d318bcd1f6e668115baeba7a6ed6d7b5faaa617f54d1c1da5dfdb93d2cb3a7a32cebdce6f1a543
MD5 SHA1 SHA512

Submit Download

naIOdxTjGyw3.bat

Path C:\Users\Admin\AppData\Local\Temp\naIOdxTjGyw3.bat
Size 207B
SHA256 95422272caddcdfead2a005cb709e79354e3fd351837bd51d76b8c7f15d64559
MD5 6493527a6575bfa7ba6658d5afb3d2ec
SHA1 5c24360fae82fdf75afcf897a6b8a540ed09f9c8
SHA512 4ea66aecf0bfca294fae6680efc23d08e5e4a6f919c589f2a3e7150436bb4d64e9ae1d1c21eba7649097877b06a5a88e7e6cde1022d044fbd71b017fa063976b
MD5 SHA1 SHA512

Submit Download

ojy4onKfa7KS.bat

Path C:\Users\Admin\AppData\Local\Temp\ojy4onKfa7KS.bat
Size 207B
SHA256 7a0c16bfa98cee04d67f181852595e833374dc30218a8e9220b68bda50cabfa1
MD5 8c0ee4a7a02d028931ecb3aac8efe5ef
SHA1 25625a788e93eba9202d9f6792b996d54d29485f
SHA512 012c6d501433473c826ac4910f7eed48c978b35d1145c1f0a30e38fe08ce3f82d85dc3b642d63a353d8e26aaa8db3c2d8941b593c524f549afe215bee0e28617
MD5 SHA1 SHA512

Submit Download

rMA0MTfMFrHq.bat

Path C:\Users\Admin\AppData\Local\Temp\rMA0MTfMFrHq.bat
Size 207B
SHA256 e79d8e1e6cd0686130db2f4754a779ccec23b08b6cfbcea507245e70de5c0281
MD5 fc9dc6002c50aeaea7eb0c2af212cdef
SHA1 f8da09314006f1f4a9c43187fbca93247ac82f7e
SHA512 2e01254d1a660e7b1fc89cacbebdabef8023e1150b9398c251fd3aca154e36cbb3b431b7d9b6f4963a620757fbe7c2ea2b7c6a04e604dafe8de4caeae29ff7d9
MD5 SHA1 SHA512

Submit Download

vXGcfh1PQuHB.bat

Path C:\Users\Admin\AppData\Local\Temp\vXGcfh1PQuHB.bat
Size 207B
SHA256 ddd120de5e4efdfc22c1067f40eb34f2372736e5b18f322c34aa4c4b8e24fed0
MD5 d17646fad534006134cde75ce497803f
SHA1 0a37dcda5d7e792b0fd01c4afd8e4f1f3f233267
SHA512 29709a1eba8f4f5f8054af23e550c191c6eb7d5e498f85dacaeb62dcd285390873a85e0e41efecef0d5c2fdff05ac8cf44beb0a64f93ac91aace8862c9f4befa
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 753e958ea04ee6a765f09e2ca60f56cc2959bb45aea66a77ee6ba3326cb36720
MD5 49a65e235d14a56d3043ddd95790e68d
SHA1 e3418e08e2c869b4970faa7f8ac166129a038770
SHA512 7e8a30bd9dd0ab92ad673f540ec6cb4f841baf57b2593618c0106fc385cfd69405b46d7b757a440d18d5c0dcc6273cd8589b5c389a1d76899ea7ffe6d603794e
SSDEEP 49152:Sv2I22SsaNYfdPBldt698dBcjH63eG0+DvJkwoGdhTHHB72eh2NT:Svb22SsaNYfdPBldt6+dBcjH/+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/332-39-0x000000001B160000-0x000000001B170000-memory.dmp

Download

memory/332-44-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/332-38-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/976-47-0x0000000001650000-0x0000000001660000-memory.dmp

Download

memory/976-51-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/976-46-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1072-54-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1072-59-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1388-36-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1388-31-0x000000001BFE0000-0x000000001BFF0000-memory.dmp

Download

memory/1388-30-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1712-148-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1712-153-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1712-149-0x000000001BC40000-0x000000001BC50000-memory.dmp

Download

memory/1920-141-0x0000000002C70000-0x0000000002C80000-memory.dmp

Download

memory/1920-145-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/1920-140-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2192-116-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2192-122-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2192-117-0x000000001B510000-0x000000001B520000-memory.dmp

Download

memory/2200-22-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2200-23-0x000000001BDB0000-0x000000001BDC0000-memory.dmp

Download

memory/2200-27-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2232-0-0x0000000000AA0000-0x0000000000DC4000-memory.dmp

Download

memory/2232-1-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2232-2-0x00000000014F0000-0x0000000001500000-memory.dmp

Download

memory/2232-9-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2556-164-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/2556-165-0x000000001BCE0000-0x000000001BCF0000-memory.dmp

Download

memory/3112-138-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3112-133-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/3112-132-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3136-108-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3136-109-0x000000001BDE0000-0x000000001BDF0000-memory.dmp

Download

memory/3136-114-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3332-82-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3332-76-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3332-77-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

Download

memory/3480-97-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/3480-93-0x00000000030A0000-0x00000000030B0000-memory.dmp

Download

memory/3480-92-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4052-129-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4052-124-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4052-125-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

Download

memory/4068-84-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4068-90-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4068-85-0x000000001B500000-0x000000001B510000-memory.dmp

Download

memory/4144-156-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4144-157-0x000000001BD60000-0x000000001BD70000-memory.dmp

Download

memory/4144-161-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4528-12-0x000000001CC10000-0x000000001CCC2000-memory.dmp

Download

memory/4528-10-0x000000001BBF0000-0x000000001BC00000-memory.dmp

Download

memory/4528-8-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4528-19-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4528-13-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4528-11-0x000000001CB00000-0x000000001CB50000-memory.dmp

Download

memory/4920-62-0x000000001B650000-0x000000001B660000-memory.dmp

Download

memory/4920-66-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4920-61-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4992-69-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/4992-73-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/5004-100-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/5004-106-0x00007FFA96D90000-0x00007FFA97852000-memory.dmp

Download

memory/5004-101-0x000000001B410000-0x000000001B420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads