quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
600s
max time network
602s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (13) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral20/memory/4684-1-0x0000000000F00000-0x0000000000F6C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Checks computer location settings 2 TTPs 28 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 29 IoCs

Processes:

pid	process
4176	Client.exe
2240	Client.exe
2988	Client.exe
3664	Client.exe
4356	Client.exe
1732	Client.exe
3232	Client.exe
2628	Client.exe
1076	Client.exe
1620	Client.exe
2696	Client.exe
2788	Client.exe
2400	Client.exe
2516	Client.exe
4056	Client.exe
2052	Client.exe
1020	Client.exe
3604	Client.exe
4908	Client.exe
2188	Client.exe
3184	Client.exe
2484	Client.exe
3664	Client.exe
2796	Client.exe
4872	Client.exe
4208	Client.exe
2484	Client.exe
2384	Client.exe
5116	Client.exe

Looks up external IP address via web service 27 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
67	ip-api.com
79	ip-api.com
85	ip-api.com
2	ip-api.com
41	ip-api.com
51	ip-api.com
56	ip-api.com
43	ip-api.com
45	ip-api.com
47	ip-api.com
81	ip-api.com
18	ip-api.com
25	ip-api.com
34	ip-api.com
38	ip-api.com
87	ip-api.com
12	ip-api.com
16	ip-api.com
32	ip-api.com
54	ip-api.com
36	ip-api.com
73	ip-api.com
83	ip-api.com
60	ip-api.com
77	ip-api.com
9	api.ipify.org
14	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
116	4176	WerFault.exe	Client.exe
1880	2240	WerFault.exe	Client.exe
1052	2988	WerFault.exe	Client.exe
4164	3664	WerFault.exe	Client.exe
3688	4356	WerFault.exe	Client.exe
5068	1732	WerFault.exe	Client.exe
4248	3232	WerFault.exe	Client.exe
4396	2628	WerFault.exe	Client.exe
2956	1076	WerFault.exe	Client.exe
4164	1620	WerFault.exe	Client.exe
1264	2696	WerFault.exe	Client.exe
3248	2788	WerFault.exe	Client.exe
1732	2400	WerFault.exe	Client.exe
4920	2516	WerFault.exe	Client.exe
2388	4056	WerFault.exe	Client.exe
1224	2052	WerFault.exe	Client.exe
5068	1020	WerFault.exe	Client.exe
5000	3604	WerFault.exe	Client.exe
3220	4908	WerFault.exe	Client.exe
2960	2188	WerFault.exe	Client.exe
4252	3184	WerFault.exe	Client.exe
3440	2484	WerFault.exe	Client.exe
2136	3664	WerFault.exe	Client.exe
3240	2796	WerFault.exe	Client.exe
1584	4872	WerFault.exe	Client.exe
3696	4208	WerFault.exe	Client.exe
4948	2484	WerFault.exe	Client.exe
2308	2384	WerFault.exe	Client.exe

Creates scheduled task(s) 1 TTPs 31 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeSCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2072	schtasks.exe
1884	schtasks.exe
2588	schtasks.exe
2740	schtasks.exe
1900	schtasks.exe
2364	schtasks.exe
4248	schtasks.exe
1684	schtasks.exe
2456	schtasks.exe
2692	schtasks.exe
4360	schtasks.exe
4512	schtasks.exe
1916	schtasks.exe
2472	schtasks.exe
2868	SCHTASKS.exe
4808	schtasks.exe
4508	schtasks.exe
1784	schtasks.exe
4472	schtasks.exe
3908	schtasks.exe
920	schtasks.exe
1416	schtasks.exe
4676	schtasks.exe
3460	schtasks.exe
2712	schtasks.exe
1116	schtasks.exe
4548	schtasks.exe
3932	schtasks.exe
1644	schtasks.exe
2980	schtasks.exe
1248	schtasks.exe

Runs ping.exe 1 TTPs 28 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
3688	PING.EXE
2280	PING.EXE
3636	PING.EXE
1996	PING.EXE
4424	PING.EXE
2344	PING.EXE
4552	PING.EXE
4032	PING.EXE
4324	PING.EXE
1848	PING.EXE
264	PING.EXE
5088	PING.EXE
3024	PING.EXE
2028	PING.EXE
1656	PING.EXE
1504	PING.EXE
4652	PING.EXE
1324	PING.EXE
4992	PING.EXE
964	PING.EXE
3680	PING.EXE
4996	PING.EXE
1440	PING.EXE
4592	PING.EXE
1628	PING.EXE
2324	PING.EXE
2804	PING.EXE
2556	PING.EXE

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

Uni - Copy (13) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	4684	Uni - Copy (13) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	4176	Client.exe
Token: SeDebugPrivilege	2240	Client.exe
Token: SeDebugPrivilege	2988	Client.exe
Token: SeDebugPrivilege	3664	Client.exe
Token: SeDebugPrivilege	4356	Client.exe
Token: SeDebugPrivilege	1732	Client.exe
Token: SeDebugPrivilege	3232	Client.exe
Token: SeDebugPrivilege	2628	Client.exe
Token: SeDebugPrivilege	1076	Client.exe
Token: SeDebugPrivilege	1620	Client.exe
Token: SeDebugPrivilege	2696	Client.exe
Token: SeDebugPrivilege	2788	Client.exe
Token: SeDebugPrivilege	2400	Client.exe
Token: SeDebugPrivilege	2516	Client.exe
Token: SeDebugPrivilege	4056	Client.exe
Token: SeDebugPrivilege	2052	Client.exe
Token: SeDebugPrivilege	1020	Client.exe
Token: SeDebugPrivilege	3604	Client.exe
Token: SeDebugPrivilege	4908	Client.exe
Token: SeDebugPrivilege	2188	Client.exe
Token: SeDebugPrivilege	3184	Client.exe
Token: SeDebugPrivilege	2484	Client.exe
Token: SeDebugPrivilege	3664	Client.exe
Token: SeDebugPrivilege	2796	Client.exe
Token: SeDebugPrivilege	4872	Client.exe
Token: SeDebugPrivilege	4208	Client.exe
Token: SeDebugPrivilege	2484	Client.exe
Token: SeDebugPrivilege	2384	Client.exe
Token: SeDebugPrivilege	5116	Client.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

pid	process
4176	Client.exe
2240	Client.exe
2988	Client.exe
3664	Client.exe
4356	Client.exe
1732	Client.exe
3232	Client.exe
2628	Client.exe
1076	Client.exe
1620	Client.exe
2696	Client.exe
2788	Client.exe
2400	Client.exe
2516	Client.exe
4056	Client.exe
2052	Client.exe
1020	Client.exe
3604	Client.exe
4908	Client.exe
2188	Client.exe
3184	Client.exe
2484	Client.exe
3664	Client.exe
2796	Client.exe
4872	Client.exe
4208	Client.exe
2484	Client.exe
2384	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (13) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exe

description	pid	process	target process
PID 4684 wrote to memory of 1684	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 4684 wrote to memory of 1684	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 4684 wrote to memory of 1684	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 4684 wrote to memory of 4176	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 4684 wrote to memory of 4176	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 4684 wrote to memory of 4176	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 4684 wrote to memory of 2868	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 4684 wrote to memory of 2868	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 4684 wrote to memory of 2868	4684	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 4176 wrote to memory of 1644	4176	Client.exe	schtasks.exe
PID 4176 wrote to memory of 1644	4176	Client.exe	schtasks.exe
PID 4176 wrote to memory of 1644	4176	Client.exe	schtasks.exe
PID 4176 wrote to memory of 400	4176	Client.exe	cmd.exe
PID 4176 wrote to memory of 400	4176	Client.exe	cmd.exe
PID 4176 wrote to memory of 400	4176	Client.exe	cmd.exe
PID 400 wrote to memory of 552	400	cmd.exe	chcp.com
PID 400 wrote to memory of 552	400	cmd.exe	chcp.com
PID 400 wrote to memory of 552	400	cmd.exe	chcp.com
PID 400 wrote to memory of 3636	400	cmd.exe	PING.EXE
PID 400 wrote to memory of 3636	400	cmd.exe	PING.EXE
PID 400 wrote to memory of 3636	400	cmd.exe	PING.EXE
PID 400 wrote to memory of 2240	400	cmd.exe	Client.exe
PID 400 wrote to memory of 2240	400	cmd.exe	Client.exe
PID 400 wrote to memory of 2240	400	cmd.exe	Client.exe
PID 2240 wrote to memory of 4808	2240	Client.exe	schtasks.exe
PID 2240 wrote to memory of 4808	2240	Client.exe	schtasks.exe
PID 2240 wrote to memory of 4808	2240	Client.exe	schtasks.exe
PID 2240 wrote to memory of 1628	2240	Client.exe	cmd.exe
PID 2240 wrote to memory of 1628	2240	Client.exe	cmd.exe
PID 2240 wrote to memory of 1628	2240	Client.exe	cmd.exe
PID 1628 wrote to memory of 4004	1628	cmd.exe	chcp.com
PID 1628 wrote to memory of 4004	1628	cmd.exe	chcp.com
PID 1628 wrote to memory of 4004	1628	cmd.exe	chcp.com
PID 1628 wrote to memory of 4996	1628	cmd.exe	PING.EXE
PID 1628 wrote to memory of 4996	1628	cmd.exe	PING.EXE
PID 1628 wrote to memory of 4996	1628	cmd.exe	PING.EXE
PID 1628 wrote to memory of 2988	1628	cmd.exe	Client.exe
PID 1628 wrote to memory of 2988	1628	cmd.exe	Client.exe
PID 1628 wrote to memory of 2988	1628	cmd.exe	Client.exe
PID 2988 wrote to memory of 2980	2988	Client.exe	schtasks.exe
PID 2988 wrote to memory of 2980	2988	Client.exe	schtasks.exe
PID 2988 wrote to memory of 2980	2988	Client.exe	schtasks.exe
PID 2988 wrote to memory of 552	2988	Client.exe	cmd.exe
PID 2988 wrote to memory of 552	2988	Client.exe	cmd.exe
PID 2988 wrote to memory of 552	2988	Client.exe	cmd.exe
PID 552 wrote to memory of 3260	552	cmd.exe	chcp.com
PID 552 wrote to memory of 3260	552	cmd.exe	chcp.com
PID 552 wrote to memory of 3260	552	cmd.exe	chcp.com
PID 552 wrote to memory of 1996	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 1996	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 1996	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 3664	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3664	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3664	552	cmd.exe	Client.exe
PID 3664 wrote to memory of 920	3664	Client.exe	schtasks.exe
PID 3664 wrote to memory of 920	3664	Client.exe	schtasks.exe
PID 3664 wrote to memory of 920	3664	Client.exe	schtasks.exe
PID 3664 wrote to memory of 3320	3664	Client.exe	cmd.exe
PID 3664 wrote to memory of 3320	3664	Client.exe	cmd.exe
PID 3664 wrote to memory of 3320	3664	Client.exe	cmd.exe
PID 3320 wrote to memory of 2196	3320	cmd.exe	chcp.com
PID 3320 wrote to memory of 2196	3320	cmd.exe	chcp.com
PID 3320 wrote to memory of 2196	3320	cmd.exe	chcp.com
PID 3320 wrote to memory of 4424	3320	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1684

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TYQxeyF7jS5w.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:552

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:3636

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\22VBg2xxN01p.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:4004

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:4996

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3ijMV2cEEDJ1.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:3260

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1996

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3664

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGPjHWiOP7s1.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:2196

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:4424

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
11⤵
- Creates scheduled task(s)
PID:1884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vNyQhPlOhtzV.bat" "
11⤵
PID:3096

C:\Windows\SysWOW64\chcp.com
chcp 65001
12⤵
PID:1264

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:4324

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
13⤵
- Creates scheduled task(s)
PID:2588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oQUzhgGTCpea.bat" "
13⤵
PID:4480

C:\Windows\SysWOW64\chcp.com
chcp 65001
14⤵
PID:3012

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:2804

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
15⤵
- Creates scheduled task(s)
PID:2740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g158YdX5HpBF.bat" "
15⤵
PID:1304

C:\Windows\SysWOW64\chcp.com
chcp 65001
16⤵
PID:2836

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:1848

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
17⤵
- Creates scheduled task(s)
PID:1900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zpqFCUl7YU5D.bat" "
17⤵
PID:3092

C:\Windows\SysWOW64\chcp.com
chcp 65001
18⤵
PID:2044

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:2344

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
19⤵
- Creates scheduled task(s)
PID:4508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fKmm4L9Ao3mg.bat" "
19⤵
PID:4108

C:\Windows\SysWOW64\chcp.com
chcp 65001
20⤵
PID:2540

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:264

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
21⤵
- Creates scheduled task(s)
PID:2712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sYppH3G2S3QG.bat" "
21⤵
PID:3656

C:\Windows\SysWOW64\chcp.com
chcp 65001
22⤵
PID:4248

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
22⤵
- Runs ping.exe
PID:4552

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
23⤵
- Creates scheduled task(s)
PID:2364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQJRo7pqAbzo.bat" "
23⤵
PID:5008

C:\Windows\SysWOW64\chcp.com
chcp 65001
24⤵
PID:1684

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
24⤵
- Runs ping.exe
PID:5088

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
24⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
25⤵
- Creates scheduled task(s)
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zRDXEu0IcwG5.bat" "
25⤵
PID:3484

C:\Windows\SysWOW64\chcp.com
chcp 65001
26⤵
PID:3136

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
26⤵
- Runs ping.exe
PID:1656

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2400

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
27⤵
- Creates scheduled task(s)
PID:1248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\38UI6wASXMdw.bat" "
27⤵
PID:4064

C:\Windows\SysWOW64\chcp.com
chcp 65001
28⤵
PID:1812

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
28⤵
- Runs ping.exe
PID:3024

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
28⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2516

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
29⤵
- Creates scheduled task(s)
PID:4248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p9NNWjLu0guE.bat" "
29⤵
PID:4084

C:\Windows\SysWOW64\chcp.com
chcp 65001
30⤵
PID:1324

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
30⤵
- Runs ping.exe
PID:1440

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
31⤵
- Creates scheduled task(s)
PID:1416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6SyfOPxraOvH.bat" "
31⤵
PID:2244

C:\Windows\SysWOW64\chcp.com
chcp 65001
32⤵
PID:2452

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
32⤵
- Runs ping.exe
PID:4032

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
33⤵
- Creates scheduled task(s)
PID:2456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xXg3zVKeH8GB.bat" "
33⤵
PID:1784

C:\Windows\SysWOW64\chcp.com
chcp 65001
34⤵
PID:4712

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
34⤵
- Runs ping.exe
PID:1504

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
34⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1020

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
35⤵
- Creates scheduled task(s)
PID:2072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ov9E4WfpCSQY.bat" "
35⤵
PID:3052

C:\Windows\SysWOW64\chcp.com
chcp 65001
36⤵
PID:232

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
36⤵
- Runs ping.exe
PID:2028

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
36⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3604

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
37⤵
- Creates scheduled task(s)
PID:1116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JXY7jC7lnGe7.bat" "
37⤵
PID:2804

C:\Windows\SysWOW64\chcp.com
chcp 65001
38⤵
PID:780

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
38⤵
- Runs ping.exe
PID:4992

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
38⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
39⤵
- Creates scheduled task(s)
PID:4472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vWn9XTRg9mSu.bat" "
39⤵
PID:3984

C:\Windows\SysWOW64\chcp.com
chcp 65001
40⤵
PID:1688

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
40⤵
- Runs ping.exe
PID:3688

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
40⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
41⤵
- Creates scheduled task(s)
PID:2692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dLJEN4Kn4vY5.bat" "
41⤵
PID:5056

C:\Windows\SysWOW64\chcp.com
chcp 65001
42⤵
PID:4844

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
42⤵
- Runs ping.exe
PID:4652

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
42⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
43⤵
- Creates scheduled task(s)
PID:4360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l3Oj1qfGV9cr.bat" "
43⤵
PID:1504

C:\Windows\SysWOW64\chcp.com
chcp 65001
44⤵
PID:1316

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
44⤵
- Runs ping.exe
PID:2280

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
44⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
45⤵
- Creates scheduled task(s)
PID:3908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IZdZPev9eCsB.bat" "
45⤵
PID:2668

C:\Windows\SysWOW64\chcp.com
chcp 65001
46⤵
PID:3696

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
46⤵
- Runs ping.exe
PID:1324

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
46⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
47⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jh10cH8SSlgZ.bat" "
47⤵
PID:1668

C:\Windows\SysWOW64\chcp.com
chcp 65001
48⤵
PID:3504

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
48⤵
- Runs ping.exe
PID:4592

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
48⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
49⤵
- Creates scheduled task(s)
PID:2472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i1jfo58twCBL.bat" "
49⤵
PID:2628

C:\Windows\SysWOW64\chcp.com
chcp 65001
50⤵
PID:2960

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
50⤵
- Runs ping.exe
PID:1628

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
50⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
51⤵
- Creates scheduled task(s)
PID:4548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0KKxhlkqWtBP.bat" "
51⤵
PID:1844

C:\Windows\SysWOW64\chcp.com
chcp 65001
52⤵
PID:1220

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
52⤵
- Runs ping.exe
PID:964

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
52⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
53⤵
- Creates scheduled task(s)
PID:4676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SfrMgJuaW8N5.bat" "
53⤵
PID:3908

C:\Windows\SysWOW64\chcp.com
chcp 65001
54⤵
PID:3692

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
54⤵
- Runs ping.exe
PID:2324

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
54⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
55⤵
- Creates scheduled task(s)
PID:3460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5btZulLnfqV4.bat" "
55⤵
PID:1312

C:\Windows\SysWOW64\chcp.com
chcp 65001
56⤵
PID:1916

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
56⤵
- Runs ping.exe
PID:2556

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
57⤵
- Creates scheduled task(s)
PID:3932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MqkLtDczpdrY.bat" "
57⤵
PID:4136

C:\Windows\SysWOW64\chcp.com
chcp 65001
58⤵
PID:1416

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
58⤵
- Runs ping.exe
PID:3680

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
59⤵
- Creates scheduled task(s)
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1704
57⤵
- Program crash
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 2256
55⤵
- Program crash
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 2220
53⤵
- Program crash
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1724
51⤵
- Program crash
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 2224
49⤵
- Program crash
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1096
47⤵
- Program crash
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1712
45⤵
- Program crash
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 2164
43⤵
- Program crash
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1656
41⤵
- Program crash
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1084
39⤵
- Program crash
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 1092
37⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1712
35⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 2196
33⤵
- Program crash
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 1688
31⤵
- Program crash
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 1668
29⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1708
27⤵
- Program crash
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2236
25⤵
- Program crash
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2248
23⤵
- Program crash
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2236
21⤵
- Program crash
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 1712
19⤵
- Program crash
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2224
17⤵
- Program crash
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1092
15⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 2232
13⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 2252
11⤵
- Program crash
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1708
9⤵
- Program crash
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 2184
7⤵
- Program crash
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 1612
5⤵
- Program crash
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 2176
3⤵
- Program crash
PID:116

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (13) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4176 -ip 4176
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2240 -ip 2240
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2988 -ip 2988
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3664 -ip 3664
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4356 -ip 4356
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1732 -ip 1732
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3232 -ip 3232
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2628 -ip 2628
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1076 -ip 1076
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1620 -ip 1620
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2696 -ip 2696
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2788 -ip 2788
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2400 -ip 2400
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2516 -ip 2516
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4056 -ip 4056
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2052 -ip 2052
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1020 -ip 1020
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3604 -ip 3604
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4908 -ip 4908
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2188 -ip 2188
1⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3184 -ip 3184
1⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4072,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2484 -ip 2484
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3664 -ip 3664
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2796 -ip 2796
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4872 -ip 4872
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4208 -ip 4208
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2484 -ip 2484
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2384 -ip 2384
1⤵
PID:3132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\22VBg2xxN01p.bat
Filesize
207B

MD5
224174efff0537972edbd6866137469e

SHA1
0747136fd0f70f2182436d7ae1551ac74b6f0df7

SHA256
6209ecf60f02abe6c51debd09cd0aa2ca842e099e7ab0d8e15b2268328ad30e2

SHA512
d74ceffe007c08bf8769f822dde02891b0ced857e87033346133464f0063eee307fe40f43b7b6f03a30f824ca714707e2acc628a6eb6c5c7dc3cc066b4ba11e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\38UI6wASXMdw.bat
Filesize
207B

MD5
f8347a3057b0dfdba4f7a8e08fe50a9f

SHA1
fb15599c54f0806a19142d67a968fe8949a6dea9

SHA256
3e9e6e71f4925b6c262b49ca3c14c148888ecd7500592face72a87f7f0b6838f

SHA512
2d008e14f9d7392aae1e745fd38de45807cde9bd2a50ffcdb236b1eb35236bd7227151e8df84fee8f650c1fff18fa4e6cfa870097202740de43e47265cb8e6e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ijMV2cEEDJ1.bat
Filesize
207B

MD5
c6bb0b7fbac0a91d809679fa205ebbf1

SHA1
90a8507329983424b738871453889284a6c3800f

SHA256
6715d6daeb5a2d4f61617d18c7daa049fa440e58b100d514c4f5556a1a61539a

SHA512
3421889b66688c863c750b6f17852da6b8d8fdea1c62f0208ad0c9377824f1a3048d684ce26b9c12938daabfa364e0efd2cc9303fe1b1df1330fd78c25cc8b29

Download Submit
C:\Users\Admin\AppData\Local\Temp\6SyfOPxraOvH.bat
Filesize
207B

MD5
2d9c271352dc22bffdb84b21b2edbfeb

SHA1
efaf45c006a4c2c443dc0e166a7fd10e812d0867

SHA256
98335b16ec988ada7e4f1359af45e60f5a3aac784e2ff18936d64a7288ad569a

SHA512
51c1df127cb8b11c21324f76c854a20818f4488b4cfd700171ae79d3db93a9666a0936c81374cc150dbee61dffb70256f201de9787d04e79b6c6a9e44879f67d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DQJRo7pqAbzo.bat
Filesize
207B

MD5
2e2429cefb8e7b4e187c732bb8a0e504

SHA1
bd9cc1ed48ed962103d9a9c7fdd50c2408647601

SHA256
7f73a14231019e7542c01461ed229d6893aaf081069f77ac4be159e9ad27b315

SHA512
e034b01def916b5c8e555f2c483b88e334e380083ba1ada410080596518781c0429ded291c3a3a7bda07d3d1e6da8e5a8c99c490c33f64b629b7516f532da405

Download Submit
C:\Users\Admin\AppData\Local\Temp\JXY7jC7lnGe7.bat
Filesize
207B

MD5
5b1bcf5a177d9fc499ff8415f0ad1f2c

SHA1
b9857202c2b0969a7bde225e521f459803d43e98

SHA256
b755db04862e4a991c346b25c43025f9e3783df8d3480ff3e59e3b7cd31e58a2

SHA512
d78a164771ae55e03aa0f1e4549d27c31ed4903083e1b0c0dfe863c7d9c802d8ecf0d6072845b8fb9df5f86ee434eab36076f2fc51e2c02063adc9b2825bc8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ov9E4WfpCSQY.bat
Filesize
207B

MD5
90d2da382f7d8967b48645fe8099a316

SHA1
12d53257fac15852cad9a170a43890570b2c60f1

SHA256
204f3c90c2d819b99d005c93ddeccf19cb5ecb13aed90b6a7794f029bcdcc689

SHA512
d0c8f7432a8205fb39558f3b39df1e1f51594bec7074444952b8dd696e208a22cb14125e511b9adc59233a54a317a03f26b3fd1a9bf0433c15b99af3facc9b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TYQxeyF7jS5w.bat
Filesize
207B

MD5
f1c8838cbeed9904b16f0758776dfce5

SHA1
79695a0bfdea7f59ba91539ccb3b98287547aec3

SHA256
a2583a05de6eb39292e1334b5b4079cad56566b443e5f94c02015cf36a78c009

SHA512
0de490ebd9b5097fc7ad4f92850b85ca7eb84fd4dbc984caa344cf2b5bfdeccf5c403a1a90dfe6fd1276eeb699aa1cd94e9c945c94b8fa31f3035dd00332d441

Download Submit
C:\Users\Admin\AppData\Local\Temp\dLJEN4Kn4vY5.bat
Filesize
207B

MD5
ac871792910075228ec3c355d3654773

SHA1
b78c40038db63dc15afe3119647c4981c1bec4aa

SHA256
980edc163ab27a8eafa9a0d6c7116847d95302f45310408570967e1bd6d891c4

SHA512
9b1216a0fc96c0c2e681bedfd37a58e52a7d457e725eefeb805262f73fdfb09ccb495e16f9dfa2ec68e2bef6cf7606e872fb54baf0b2033ffc8da29e0aa89139

Download Submit
C:\Users\Admin\AppData\Local\Temp\fKmm4L9Ao3mg.bat
Filesize
207B

MD5
89e9a18f1154340ceab3fbba6a5cbd34

SHA1
5f9ab1ea162b8b9a0e88c89ba107d3739075aa1f

SHA256
517e9b67b5fd99b518a6766cea948821e55e8e77dd703b1edd90a4fb0538d5c1

SHA512
b4edb75eec5f623f53cbce7ab8b25a50d931ae4b67651ce139c9eaf76906dfe0db61943437035b913acf1b66e23860da977b5d8a9bbb511802f2c8a6d268815b

Download Submit
C:\Users\Admin\AppData\Local\Temp\g158YdX5HpBF.bat
Filesize
207B

MD5
3cdfc00ca679e26c9ee586ae59a9888e

SHA1
40ba188f114917c2aa34691b1162397b7d6487bd

SHA256
7913867732ea9f2d84c0fd1b99389ec42e9b225e667b9483e6fd0d031d85fe78

SHA512
c5136f4918b216b189e7ff3fe40180704f99970b85d06cb733669ed3a71bb5e9c4784b5ca4cce760116c5cf3d7525494c30fc58b6bc57e40bec32acf53d213ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\l3Oj1qfGV9cr.bat
Filesize
207B

MD5
65e60091186d87d8034f4474ebe30dbb

SHA1
21ac94727b016715ace1f797593537ace9629faf

SHA256
ed4c447b57cda72ecf82388b982b0bc71781fa6edfbd1498c2152f6519840d53

SHA512
819545d68232cb62c7b64de343d3263a7e9aa989f7aee23a447d0fbe9fed1f0b06a6df85b2f2600f6fde0a695f7c8d050111ff5043374879055ef51a794ac9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\oQUzhgGTCpea.bat
Filesize
207B

MD5
f8955060c67b7b48c0c5219b9ab13fa1

SHA1
56a72594759aced82fa4d24a4d91265883f2ca98

SHA256
101208fc71d9d992afe7f7d0dd2bd0cd8543149e18a175acdb0cb8608a74ccb4

SHA512
445e7d9f70e3bd34db51db037ccad5f1347d954da77e2ba3f8525eb170946ba32601c5a6dad2a93d2e323d0e4a2a95764b20c114ee65ecc7272452fa43953f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\p9NNWjLu0guE.bat
Filesize
207B

MD5
e68f3085173a5f5b06c1deecb756dab1

SHA1
c41dead3b2ecfa23c5831e5547e25d810ed97ecb

SHA256
6478fbb41b9960b903a6f3355484ba115d9795aa99b718e1c46373d93504cc79

SHA512
bcbe51e25d8d28b468b74cb6328cdc2ceb32c3addde41bdd8b35dff9f9097ed173cd85ded59a7070ab7dc23fa03c243c0873f4b6ab47404961fcd36be8693d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\sYppH3G2S3QG.bat
Filesize
207B

MD5
6216b258ec876d8eb75b865f07f726f4

SHA1
99650aee73d192a2c684c3df8db6341be99c2749

SHA256
ac203b18c2fe95c258d213b91a54613af043f2b9a91486408306e7a90d20795d

SHA512
c7adfc8afeb8636982e2dbaceee4c1ad50e95dc3c577698205eda534412ffece967d4fead806c20c8d986bcf1c5deafa28b57e32942bbfe1a96fbcf7484c4032

Download Submit
C:\Users\Admin\AppData\Local\Temp\vNyQhPlOhtzV.bat
Filesize
207B

MD5
3959a02374d6c6a85e2650bb001ee758

SHA1
e612f7cd796760ca1930839ea147e9d6a36b85a0

SHA256
757464e831cc572e29ca45bb2fadd6e08c0d7857d988def42b962a16677989e5

SHA512
561ad161b4a03a786ef6190f0d84899e6db8f770465ab5d35fd5dc492585f5098a292daf05167bd254e6d0fb1125e7677179c803c4d23713f2b1221532a94741

Download Submit
C:\Users\Admin\AppData\Local\Temp\vWn9XTRg9mSu.bat
Filesize
207B

MD5
24d5882a6a669123df1d70a6b39ee36c

SHA1
568767225eec20d621b848604ea0afaa0bba447e

SHA256
37fefa57f67ce160be01f48e92a6ca2892ddeab4d6d87b7262e5b2ee19f72526

SHA512
e79eecbf43afdabebe65a14fdca4dd2aa706d0719f21d62a953123f6f30653a4ca8a9e4ec1c46e8383a854e4a98ce44652f3818f88bfc92a0a7c5cb7975a593c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xXg3zVKeH8GB.bat
Filesize
207B

MD5
febfefe455b922c0d0ce63703e9f4cab

SHA1
9adfdc6b0c4ba7eb1ea7ceb22a7ac5ec83654d74

SHA256
d0c79a4d0837f8a0a10fd6108b7958531032bd8b00ba645fc3a7df01fa93ba37

SHA512
6254bb110d8a8b4afa3bcf430018f8689108eea0f350dcd301d4a81adc0a20f5c8329798c2928fa38f620fa58ee172c8b8f0c84e9dcbed0096338f4d749f9c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\yGPjHWiOP7s1.bat
Filesize
207B

MD5
054f42337ed8b1fe9f6d0cb5f390b0d8

SHA1
a0c103ee18d03eca73a7405588e38134b2321007

SHA256
c811d3aad3193829fa6e2ed336dc2daa0227fd5c974c3277c0bab6900151b817

SHA512
2d6b91260f5e5b7fb226700cd23e5295a27eac2e5db75aec021f46442f2de6c8a49add7d98484dd983fc17876f0a7c5daccd189d4c3f473ca3ac764be1715ef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zRDXEu0IcwG5.bat
Filesize
207B

MD5
bc8158fd1430468b0e1d60d9b2aa4d72

SHA1
d43abaa302c3a64eda527bb22cfe40a0bca1956b

SHA256
e158d1c87a59637718a72f600c0efa9b2c68fdd6a0276bee2cb9580789953a0d

SHA512
c613910af96de75fd26cce869dd51b492ddc4cb978df038a2d1e75e2c40c9623a22aa650a7783b26316eedd84a629dc60a973fb7c80b3e4a7787c5da8798aae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zpqFCUl7YU5D.bat
Filesize
207B

MD5
337d29eca03715b65ee3c41b706bb4f7

SHA1
ffe994ad417eece9b263215cb4940445c3765a2e

SHA256
2f3607b986e23a2d8227f404d27fe0c57e96908ef6361f0d1ea0bb773af452fc

SHA512
81ba7e59a145eb09daba2d43edc7fb6618c04ce8155638c068a7c9da3efaad2e40d7305e0299b0b9a22274dfb779b3785544510ff871dba3ff92ddcf24e88100

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
e2a0b8825641683b49f5a85deb138d1b

SHA1
256a90795aaa2ff51bc4c626a17b9b74f9134791

SHA256
84e9daa6dceca5ae9234469aa958ff461fb466a669cc72ec6a93fb0014903a33

SHA512
6e432e73536d1cbd822f3b8c54000f6cee4fb535ad8fb769d2793f04d5e5f4ba686584aca89f48cc29e24e82d6306c7213c8dc1ece4b3f43fbfde7f79796c62c

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
caeae6d87821d4f37aeeb1add140ce87

SHA1
d17cab1014ae79d7976c766913ec03ff960707b2

SHA256
bdc63b925f0b2dc48eeb73f03f94543e5794495516f238f7a29bb5cd355f1ba8

SHA512
87ba338b9e73461046573cab7581a60a971ce6c844c95af9349b78e6a37f3d0a22157d48fe4c164bc2245e87121e5bd24300cb646915bf00b0a794cc369950d3

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
db8cb88f68ed559e2414585f4aba1f56

SHA1
8c80b63623dd60bd9455adb77eabd52d3072c377

SHA256
91e08125a6e1e3b2606daf4d14bec455300bdbd7b4abeb6cba70dfcd062a0a39

SHA512
72c9f8b9cad0960246114212fc845f13981570ee2792d603a7cef2a2a97fa50cb651532f0d0d6086971427e26d5e30aff56dace43d526c2d18d39680b8e42a10

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
38cdc1595e78b0c3e46ef3405524af1b

SHA1
89657365b8ecb4ecd0c3809658ebf6c0be46a598

SHA256
71dd1e55fb51fcd6266f7a3e1c5c81a655315aa9b70efd5fe8c61e946d9032a4

SHA512
66aea15e6f7938f47b932150928939b1e2dee603171543318184ac9c78df64f84150a10e1bd29f0ea9e595e67f0c4aec784aea288a220d637f5f5f15c868379f

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
da7a75c097e718be502a9725c8ba8132

SHA1
09016310a8fb09ffffada0d370a8d7f9d82e54cf

SHA256
1c6cad085c814d35b6788da6ec5d38a38ed92544aca79858920acef188cb3aff

SHA512
85a14f0c04555ca3a81a930354c3f9fe4c3ada595ed00d6507df6018dcc8181df47e175b274eccf3871c13e4180903c87abfda203f68646ba10046332fbc8f96

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\06-10-2024
Filesize
224B

MD5
48d2b74b09b4f84193d95791bf1fed05

SHA1
d0169be3d848249e1ef3b66f46b3f50e9689d9e8

SHA256
a9a331907efa51f25c5363b1526635208b5a794b9bba1ef328eeb5cb36fb7e28

SHA512
419d4edf320937e209332dcaf02c569296ce249e6665489fbf889f30c36f48f6dffadedeb68bc1e352eea4510ab716441c61c167b9118defab52651350407eb7

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/4176-24-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4176-15-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4176-17-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4176-19-0x00000000068B0000-0x00000000068BA000-memory.dmp

Filesize
40KB

Download
memory/4684-8-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4684-6-0x0000000005FF0000-0x0000000006002000-memory.dmp

Filesize
72KB

Download
memory/4684-7-0x00000000752BE000-0x00000000752BF000-memory.dmp

Filesize
4KB

Download
memory/4684-5-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/4684-4-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4684-16-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4684-3-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/4684-0-0x00000000752BE000-0x00000000752BF000-memory.dmp

Filesize
4KB

Download
memory/4684-2-0x00000000060C0000-0x0000000006664000-memory.dmp

Filesize
5.6MB

Download
memory/4684-1-0x0000000000F00000-0x0000000000F6C000-memory.dmp

Filesize
432KB

Download