Overview

overview

10

Static

static

10

sp00fer.exe

windows7-x64

10

sp00fer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1193s
  • max time network
    1198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 22:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sp00fer.exe
  • Size 3.1MB
  • Sample240629-2qrcaasank
  • SHA256 7849231d077a00fd9129c2c6cecbb3287afc5656b8dfd263fdf57e2432d4f335
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • pringelsy-51954.portmap.host:51954

Mutex

  • 6dc28d35-3024-44a7-a559-f9991015fa39

Attributes
  • encryption_key

    3107DF2D44BB6914C55BEA57D100135AB0F278DF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    799

  • startup_key

    Quasar Client Startup

  • subdirectory

    Common Files

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 56 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 57 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 56 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 58 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\sp00fer.exe
    "C:\Users\Admin\AppData\Local\Temp\sp00fer.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2444
    • C:\Program Files\Common Files\Client.exe
      "C:\Program Files\Common Files\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9milzwDyGjow.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2596
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:688
          • C:\Program Files\Common Files\Client.exe
            "C:\Program Files\Common Files\Client.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3092
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kNmGobdPK4ej.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4004
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:3724
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:448
                • C:\Program Files\Common Files\Client.exe
                  "C:\Program Files\Common Files\Client.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2760
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3168
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AE5Czrl8ZSxU.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4584
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:3740
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:3668
                      • C:\Program Files\Common Files\Client.exe
                        "C:\Program Files\Common Files\Client.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:4372
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3764
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LAwaLImXzJgM.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2668
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:1280
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:2132
                            • C:\Program Files\Common Files\Client.exe
                              "C:\Program Files\Common Files\Client.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:2688
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                11⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:4128
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6kamOhoB7mVe.bat" "
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4520
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:1588
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • Runs ping.exe
                                    PID:3624
                                  • C:\Program Files\Common Files\Client.exe
                                    "C:\Program Files\Common Files\Client.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4524
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                      13⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3280
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\35GueDsOjmBq.bat" "
                                      13⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2924
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        14⤵
                                          PID:3680
                                        • C:\Windows\system32\PING.EXE
                                          ping -n 10 localhost
                                          14⤵
                                          • Runs ping.exe
                                          PID:3084
                                        • C:\Program Files\Common Files\Client.exe
                                          "C:\Program Files\Common Files\Client.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2268
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                            15⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3692
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2dqcK1cdBzLb.bat" "
                                            15⤵
                                              PID:3260
                                              • C:\Windows\system32\chcp.com
                                                chcp 65001
                                                16⤵
                                                  PID:1724
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 10 localhost
                                                  16⤵
                                                  • Runs ping.exe
                                                  PID:3176
                                                • C:\Program Files\Common Files\Client.exe
                                                  "C:\Program Files\Common Files\Client.exe"
                                                  16⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:704
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                    17⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2208
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CjqbtOpWkCeY.bat" "
                                                    17⤵
                                                      PID:2304
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        18⤵
                                                          PID:2584
                                                        • C:\Windows\system32\PING.EXE
                                                          ping -n 10 localhost
                                                          18⤵
                                                          • Runs ping.exe
                                                          PID:1448
                                                        • C:\Program Files\Common Files\Client.exe
                                                          "C:\Program Files\Common Files\Client.exe"
                                                          18⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2168
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                            19⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2296
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bktKbHWPKI9H.bat" "
                                                            19⤵
                                                              PID:2124
                                                              • C:\Windows\system32\chcp.com
                                                                chcp 65001
                                                                20⤵
                                                                  PID:4068
                                                                • C:\Windows\system32\PING.EXE
                                                                  ping -n 10 localhost
                                                                  20⤵
                                                                  • Runs ping.exe
                                                                  PID:512
                                                                • C:\Program Files\Common Files\Client.exe
                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                  20⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1220
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                    21⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4872
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d8rhUQqspRVX.bat" "
                                                                    21⤵
                                                                      PID:3356
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 65001
                                                                        22⤵
                                                                          PID:4832
                                                                        • C:\Windows\system32\PING.EXE
                                                                          ping -n 10 localhost
                                                                          22⤵
                                                                          • Runs ping.exe
                                                                          PID:3624
                                                                        • C:\Program Files\Common Files\Client.exe
                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                          22⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4824
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                            23⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:3280
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bgjAKEgxfQIT.bat" "
                                                                            23⤵
                                                                              PID:2344
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                24⤵
                                                                                  PID:112
                                                                                • C:\Windows\system32\PING.EXE
                                                                                  ping -n 10 localhost
                                                                                  24⤵
                                                                                  • Runs ping.exe
                                                                                  PID:2432
                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                  24⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3692
                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                    25⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:1244
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeBu7aPugWui.bat" "
                                                                                    25⤵
                                                                                      PID:3752
                                                                                      • C:\Windows\system32\chcp.com
                                                                                        chcp 65001
                                                                                        26⤵
                                                                                          PID:948
                                                                                        • C:\Windows\system32\PING.EXE
                                                                                          ping -n 10 localhost
                                                                                          26⤵
                                                                                          • Runs ping.exe
                                                                                          PID:876
                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                          26⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4132
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                            27⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:1224
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XBEumwPGwjzM.bat" "
                                                                                            27⤵
                                                                                              PID:228
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                28⤵
                                                                                                  PID:4756
                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  28⤵
                                                                                                  • Runs ping.exe
                                                                                                  PID:2996
                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                  28⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1612
                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                    29⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4380
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yflMFBI3IkUM.bat" "
                                                                                                    29⤵
                                                                                                      PID:2692
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        30⤵
                                                                                                          PID:1576
                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                          ping -n 10 localhost
                                                                                                          30⤵
                                                                                                          • Runs ping.exe
                                                                                                          PID:4680
                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                          30⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4584
                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                            31⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:4152
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wN2haC3sLfVk.bat" "
                                                                                                            31⤵
                                                                                                              PID:3180
                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                chcp 65001
                                                                                                                32⤵
                                                                                                                  PID:1100
                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                  ping -n 10 localhost
                                                                                                                  32⤵
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:3396
                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                  32⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2828
                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                    33⤵
                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                    PID:116
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oxaI8cRKxP8O.bat" "
                                                                                                                    33⤵
                                                                                                                      PID:4740
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        34⤵
                                                                                                                          PID:888
                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                          ping -n 10 localhost
                                                                                                                          34⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:548
                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                          34⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5112
                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                            35⤵
                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                            PID:3324
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQb2sGQ7zpsX.bat" "
                                                                                                                            35⤵
                                                                                                                              PID:4168
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                36⤵
                                                                                                                                  PID:752
                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                  ping -n 10 localhost
                                                                                                                                  36⤵
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:2412
                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                  36⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:3828
                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                    37⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:980
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqljrWh26B6i.bat" "
                                                                                                                                    37⤵
                                                                                                                                      PID:1664
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        38⤵
                                                                                                                                          PID:1692
                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                          ping -n 10 localhost
                                                                                                                                          38⤵
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:2956
                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                          38⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4092
                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                            39⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:1724
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAPHP3eO1gh0.bat" "
                                                                                                                                            39⤵
                                                                                                                                              PID:1056
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                40⤵
                                                                                                                                                  PID:2648
                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                  40⤵
                                                                                                                                                  • Runs ping.exe
                                                                                                                                                  PID:2400
                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                  40⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2208
                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                    41⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:3880
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VxQvzUuU56wx.bat" "
                                                                                                                                                    41⤵
                                                                                                                                                      PID:3940
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        42⤵
                                                                                                                                                          PID:2160
                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                          42⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:2996
                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                          42⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2808
                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                            43⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:4500
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROlRyT63dnEl.bat" "
                                                                                                                                                            43⤵
                                                                                                                                                              PID:1292
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                44⤵
                                                                                                                                                                  PID:2764
                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:1548
                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:4440
                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                    45⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:2200
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gpbav95kcfqP.bat" "
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:1092
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        46⤵
                                                                                                                                                                          PID:2528
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                          46⤵
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:180
                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                          46⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:3528
                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                            47⤵
                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                            PID:3884
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iHeRBYZjR8bE.bat" "
                                                                                                                                                                            47⤵
                                                                                                                                                                              PID:2072
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                48⤵
                                                                                                                                                                                  PID:1736
                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                  48⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:2000
                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                  48⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:940
                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                    49⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:516
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1nUwduxQH15t.bat" "
                                                                                                                                                                                    49⤵
                                                                                                                                                                                      PID:1456
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        50⤵
                                                                                                                                                                                          PID:4168
                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                          50⤵
                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                          PID:5000
                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                          50⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:980
                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                            51⤵
                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                            PID:5024
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l94FOAWDHegm.bat" "
                                                                                                                                                                                            51⤵
                                                                                                                                                                                              PID:2968
                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                52⤵
                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                    PID:1744
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5daePeklLQFv.bat" "
                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m4vW7oyX5GsO.bat" "
                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                              PID:912
                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SiqsmBzcOCxq.bat" "
                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MVwJWKE7k8qj.bat" "
                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:3492
                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsO3C8uLrnmZ.bat" "
                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                      PID:456
                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:1184
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oubrzznW1q2P.bat" "
                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                  PID:844
                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:1692
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                    PID:840
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MIeA3PUcpdEE.bat" "
                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                          PID:1012
                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2020
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAYToWi2AZ1K.bat" "
                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgfDczUZzQIv.bat" "
                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                          PID:228
                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oInC2DXY36Ng.bat" "
                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o59c2KXZF3hZ.bat" "
                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                      PID:3836
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ON0bOeGcKPWy.bat" "
                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                  PID:3324
                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9sdHtkTvsKej.bat" "
                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                      PID:3572
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FANaXMSknSxW.bat" "
                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                  PID:392
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ZGq4XwVVzUe.bat" "
                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LutrLlLbVxoZ.bat" "
                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                  PID:5084
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iLl9cRymHfiT.bat" "
                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                      PID:2104
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmNnICVskvHx.bat" "
                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                              PID:780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                  PID:116
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ka7qntQgyIyY.bat" "
                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xKwvhMSmBeWs.bat" "
                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4488
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAEzsvulKqAb.bat" "
                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qfONVLCiRvfx.bat" "
                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAba5Uky3sfZ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LMDvnZl7UO36.bat" "
                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2RaCayx6yTxB.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                          PID:780
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1qfJK8mxytuS.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COYL3uSbc1Si.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i6s8Xtrq4Sff.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y39opqbpx8xn.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2KEnJIzI94hQ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ejMtZynZqvL8.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\Client.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\Common Files\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3920

                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            Client.exe
                                                                                                                                                                                                                            • Path C:\Program Files\Common Files\Client.exe
                                                                                                                                                                                                                            • Size 3.1MB
                                                                                                                                                                                                                            • SHA256 7849231d077a00fd9129c2c6cecbb3287afc5656b8dfd263fdf57e2432d4f335
                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            Client.exe.log
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                            • SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            1nUwduxQH15t.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\1nUwduxQH15t.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 30e4aa39220c2ec3f4c87de031645ff7074e0d20dddf5edbcf4913e36fc10f8c
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            2dqcK1cdBzLb.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2dqcK1cdBzLb.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 9bed1575bb7c307acb855bcdc4c5337e7f79373a3c95c5f7349ba4578fc6a773
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            35GueDsOjmBq.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\35GueDsOjmBq.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 c057f12faed7af2f9f8581589f887965c35f4cd94fa264f8898d7436db7bde79
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            5daePeklLQFv.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5daePeklLQFv.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 85a5c71fb5cf5f79e135ce1f7607733b2685c4e2116d4cb366a4c0f00650dfe3
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            6kamOhoB7mVe.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\6kamOhoB7mVe.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 f915cbc57428c95d6b2e79f224824e53169d8b61adf6f7428f98da1734719846
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            9milzwDyGjow.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\9milzwDyGjow.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 b986f6068f56f58cc29f4868508b17577f68009fcee09fad8147c15a59a137ff
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            AE5Czrl8ZSxU.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AE5Czrl8ZSxU.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 c308b943190efd3f3cf4df8084d202b2a762c816410636930eff51a9bba1b5af
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            CjqbtOpWkCeY.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CjqbtOpWkCeY.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 de7c528e9e645c2777565cc36e2b1d5783465fb0e66d4caab8cb86f886fb4e92
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            Gpbav95kcfqP.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Gpbav95kcfqP.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 3e9c0c00daeff32001c85721aac4a3d3b0e1a2a869f480486faf9c77c930233d
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            HsO3C8uLrnmZ.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\HsO3C8uLrnmZ.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 5e44bf0e27b7543310c48b269ad2f87be9c079c0d2540be1aae4f662e772fdf3
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            LAwaLImXzJgM.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\LAwaLImXzJgM.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 85cc56c10c7a3a2f8c29ba3a4e06033a1aa1f62473edd855e579d25c94693065
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            LeBu7aPugWui.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\LeBu7aPugWui.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 a112b27cc1c518c38a9e85973b3230d5ffcb2fe1ac5060a61eb1dec4b63144ee
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            MVwJWKE7k8qj.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MVwJWKE7k8qj.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 0e6fa2e0024094933945fb4ae4fe007467bbeb39b7876b7216bff6d2d13e8dc7
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            RAPHP3eO1gh0.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RAPHP3eO1gh0.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 bf906992a53117ac707794d4e9cc09be11a4f89cfdaf08561fde20243734d861
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            ROlRyT63dnEl.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ROlRyT63dnEl.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 6f8d82f9e6bae6e82d0b5ea84bd3dbebd1b2f5316ad593fe0ad0718426f49ab6
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            SiqsmBzcOCxq.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\SiqsmBzcOCxq.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 342703a9b35c4a7b250c7bee06190d64789b5130763a84e83fce727bb4809d2f
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            VxQvzUuU56wx.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\VxQvzUuU56wx.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 d9b2a24dc5163586004e170882d242012b4cd8a0d3575b36871ca86ad6e4cca7
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            XBEumwPGwjzM.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\XBEumwPGwjzM.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 a74dff5c62b739310ba1bb7d9da842f4cc42ca02356d8338839765d0d7654b9a
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            bgjAKEgxfQIT.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\bgjAKEgxfQIT.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 2b56f241133a17464afe0deacd78569180be2b00c0c85dd7e41c81a66721655e
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            bktKbHWPKI9H.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\bktKbHWPKI9H.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 50741272e040a427aabda2655911b4fb6fd34a5e7f542fb2f70c469a57ee42a0
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            d8rhUQqspRVX.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\d8rhUQqspRVX.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 4709d4379846f412ef86e7bdc8f756014a88884ccb98afa6323903ad345761a1
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            hQb2sGQ7zpsX.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\hQb2sGQ7zpsX.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 cfe99d0dafe47b5fde8d4e1171d4a130fe66f2ed3fd6c0e7d44500e0121a0654
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            iHeRBYZjR8bE.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\iHeRBYZjR8bE.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 b784910b80b4465edc54c7d69233756a28e91c081656c15201b952453166e247
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            kNmGobdPK4ej.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\kNmGobdPK4ej.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 20240d9b2c3b63f6d5a5c4c794d9700ee4cbd2e02f6260722c333b15f1c42a04
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            l94FOAWDHegm.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\l94FOAWDHegm.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 53261430c523d540ae82b1463824f603416cdf5fbea7c8797c0d8f78069c1dca
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            m4vW7oyX5GsO.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\m4vW7oyX5GsO.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 a3b008a6c486795dee94a510598235db01435be9db5854cdca9cc084c748b542
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            oubrzznW1q2P.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oubrzznW1q2P.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 2b7164f2545d7812736b5674946c1a77459d74e00879a2eb4a7b2d1fbe526f8f
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            oxaI8cRKxP8O.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oxaI8cRKxP8O.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 2541eadd4ffd65fa09cdb19e0ca05dafec1257fd2ff9e3d6aabc8d56e9f90187
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            tqljrWh26B6i.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tqljrWh26B6i.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 3aff9634454b2f03090ba0d18bf4019ef7f3502d54e40b53aee65dc3069c09cc
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            wN2haC3sLfVk.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wN2haC3sLfVk.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 1d3de1bafc3c4149c0971017a070b73cb3f2d2a74ef24625b7d33bfa8c27a058
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            yflMFBI3IkUM.bat
                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yflMFBI3IkUM.bat
                                                                                                                                                                                                                            • Size 199B
                                                                                                                                                                                                                            • SHA256 bfaa8a324f7527fdce16bf15a078b9aae2dd611cc30d789233eacc0223d09f89
                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                            memory/1456-0-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1456-1-0x0000000000970000-0x0000000000C94000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1456-2-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1456-9-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1992-18-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1992-10-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1992-11-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1992-12-0x000000001E310000-0x000000001E360000-memory.dmp
                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                            memory/1992-13-0x000000001E420000-0x000000001E4D2000-memory.dmp
                                                                                                                                                                                                                            Download