Analysis
-
max time kernel
2s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-08-2024 23:58
General
-
Target
BootstrapperV1.16.exe
-
Size
381KB
-
MD5
12d943d0d655d4d54b91d175c3e46e02
-
SHA1
9b115a4874f3da04e29315e09e50a2d61b826de8
-
SHA256
9d6024dfb9f60054eb1316eb33bf8cbc5c802d9e477a9603db5e1ed585e556f8
-
SHA512
1746222789c3f480f9364f3dd654f41be5ed3d520a58f5cd69e0cd08a8d59b81a796c6ac3e6603db493f3d5a48bc748280e19cfd48f4925f7fc38b16b9e38640
-
SSDEEP
6144:mSncRleSncRlFSncRl0snwou0bUrCsnwou0bUr:r4p4O4Dnwou5vnwou5
Score
10/10
Malware Config
Extracted
Family
toxiceye
C2
https://api.telegram.org/bot7302074945:AAGKx5TnjPyRM_fqN4XQLd4uz-PUp4nl8w4/sendMessage?chat_id=6414125020
Signatures
-
ToxicEye
ToxicEye is a trojan written in C#.
-
Executes dropped EXE 34 IoCs
-
Loads dropped DLL 34 IoCs
-
Enumerates processes with tasklist 1 TTPs 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Delays execution with timeout.exe 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"10⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"11⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"14⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"15⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"16⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"17⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"18⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"19⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"21⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"23⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"24⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"25⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"27⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"28⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"29⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"30⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"31⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"33⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"34⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"35⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"36⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"40⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"43⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"56⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"58⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"60⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"61⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"62⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"63⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"64⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"66⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"68⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"74⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"76⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"78⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"80⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"82⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"84⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"86⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"88⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"90⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"92⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"94⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"96⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"98⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"100⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"102⤵
-
C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.16.EXE"103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"87⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"88⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"86⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"87⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"84⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"85⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"83⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"84⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"82⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"83⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.bat83⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"81⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"82⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"80⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"81⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8E7A.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8E7A.tmp.bat81⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"79⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"80⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"78⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"79⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"77⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"78⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8CD5.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8CD5.tmp.bat78⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"76⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"77⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp951E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp951E.tmp.bat77⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"75⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"76⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8B2F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8B2F.tmp.bat76⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"74⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"75⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp94B1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp94B1.tmp.bat75⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"73⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"74⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.bat74⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3948"75⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"75⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak75⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3948"75⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"75⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak75⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3948"75⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"75⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"72⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"73⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8EC8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8EC8.tmp.bat73⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"71⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"72⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp81CD.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp81CD.tmp.bat72⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4864"73⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"73⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak73⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"73⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"70⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"71⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp844D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp844D.tmp.bat71⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3144"72⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"72⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak72⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3144"72⤵
-
-
C:\Windows\system32\find.exefind ":"72⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"69⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"70⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp82A7.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp82A7.tmp.bat70⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3184"71⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"71⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak71⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"71⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"68⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"69⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp81EC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp81EC.tmp.bat69⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2292"70⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"70⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak70⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"70⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"67⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"68⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7A6D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7A6D.tmp.bat68⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1668"69⤵
-
-
C:\Windows\system32\find.exefind ":"69⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak69⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"69⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"66⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"67⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp848B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp848B.tmp.bat67⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4516"68⤵
-
-
C:\Windows\system32\find.exefind ":"68⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak68⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"68⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"65⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"66⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7F8C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7F8C.tmp.bat66⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3380"67⤵
-
-
C:\Windows\system32\find.exefind ":"67⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak67⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"67⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"64⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"65⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp78D8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp78D8.tmp.bat65⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2260"66⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"66⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak66⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"66⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"63⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"64⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7DB8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7DB8.tmp.bat64⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2528"65⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"65⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak65⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"65⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"62⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"63⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7C32.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7C32.tmp.bat63⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3220"64⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"64⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak64⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"64⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"61⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"62⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp70BD.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp70BD.tmp.bat62⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4892"63⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"63⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak63⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"63⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"60⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"61⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7002.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7002.tmp.bat61⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4112"62⤵
-
-
C:\Windows\system32\find.exefind ":"62⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak62⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"62⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"59⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"60⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7021.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7021.tmp.bat60⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4592"61⤵
-
-
C:\Windows\system32\find.exefind ":"61⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak61⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"61⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"58⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"59⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp733D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp733D.tmp.bat59⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 912"60⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"60⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak60⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"60⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"57⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"58⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6FE3.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6FE3.tmp.bat58⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4044"59⤵
-
-
C:\Windows\system32\find.exefind ":"59⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak59⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4044"59⤵
-
-
C:\Windows\system32\find.exefind ":"59⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak59⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4044"59⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"59⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak59⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4044"59⤵
-
-
C:\Windows\system32\find.exefind ":"59⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak59⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4044"59⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"59⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"56⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"57⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp69EA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp69EA.tmp.bat57⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1328"58⤵
-
-
C:\Windows\system32\find.exefind ":"58⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak58⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"55⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"56⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6E1E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6E1E.tmp.bat56⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4944"57⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"57⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak57⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"57⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"58⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"54⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"55⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp67E7.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp67E7.tmp.bat55⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4696"56⤵
-
-
C:\Windows\system32\find.exefind ":"56⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak56⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"56⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"57⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"53⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"54⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6BFC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6BFC.tmp.bat54⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4420"55⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"55⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak55⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"55⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"56⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"52⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"53⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6E3D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6E3D.tmp.bat53⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4132"54⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"54⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak54⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4132"54⤵
-
-
C:\Windows\system32\find.exefind ":"54⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak54⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4132"54⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"54⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak54⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4132"54⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"54⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak54⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"54⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"51⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"52⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6355.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6355.tmp.bat52⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1708"53⤵
-
-
C:\Windows\system32\find.exefind ":"53⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak53⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"53⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"54⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"50⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"51⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat51⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1268"52⤵
-
-
C:\Windows\system32\find.exefind ":"52⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak52⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"52⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"53⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"49⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"50⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5E65.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5E65.tmp.bat50⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2624"51⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"51⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak51⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2624"51⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"51⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak51⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2624"51⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"51⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak51⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"51⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"52⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"48⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"49⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5DC9.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5DC9.tmp.bat49⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4084"50⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"50⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak50⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"50⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"51⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"47⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"48⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6393.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6393.tmp.bat48⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3004"49⤵
-
-
C:\Windows\system32\find.exefind ":"49⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak49⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"49⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"50⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"46⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"47⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp61DF.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp61DF.tmp.bat47⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2196"48⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"48⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak48⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"48⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"49⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"45⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"46⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5EB3.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5EB3.tmp.bat46⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3964"47⤵
-
-
C:\Windows\system32\find.exefind ":"47⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak47⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"47⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"48⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"44⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"45⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5E08.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5E08.tmp.bat45⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3864"46⤵
-
-
C:\Windows\system32\find.exefind ":"46⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak46⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"43⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"44⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp52E1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp52E1.tmp.bat44⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3756"45⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"45⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak45⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"45⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"46⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"42⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"43⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5274.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5274.tmp.bat43⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3616"44⤵
-
-
C:\Windows\system32\find.exefind ":"44⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak44⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"44⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"45⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"41⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"42⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5E66.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5E66.tmp.bat42⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3356"43⤵
-
-
C:\Windows\system32\find.exefind ":"43⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak43⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"43⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"44⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"40⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"41⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp57D1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp57D1.tmp.bat41⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3192"42⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"42⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak42⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"42⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"43⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"39⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"40⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5522.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5522.tmp.bat40⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3096"41⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"41⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak41⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"38⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"39⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp53AC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp53AC.tmp.bat39⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2388"40⤵
-
-
C:\Windows\system32\find.exefind ":"40⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak40⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"40⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"41⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"37⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"38⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5C43.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5C43.tmp.bat38⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2344"39⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"39⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak39⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"39⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"40⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"36⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"37⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5256.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5256.tmp.bat37⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2208"38⤵
-
-
C:\Windows\system32\find.exefind ":"38⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak38⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"38⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"39⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"35⤵
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"36⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4F58.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4F58.tmp.bat36⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2536"37⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"37⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak37⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"37⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"38⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"35⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5E46.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5E46.tmp.bat35⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2660"36⤵
-
-
C:\Windows\system32\find.exefind ":"36⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak36⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"36⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"37⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"34⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp59F3.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp59F3.tmp.bat34⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 828"35⤵
-
-
C:\Windows\system32\find.exefind ":"35⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak35⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"35⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"36⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"33⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4AC6.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4AC6.tmp.bat33⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2796"34⤵
-
-
C:\Windows\system32\find.exefind ":"34⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak34⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"34⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"35⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"32⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp56A8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp56A8.tmp.bat32⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2684"33⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"33⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak33⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"33⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"34⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"31⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5245.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5245.tmp.bat31⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 264"32⤵
-
-
C:\Windows\system32\find.exefind ":"32⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak32⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"32⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"33⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"30⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp586D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp586D.tmp.bat30⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak31⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2340"31⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"31⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"29⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4D84.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4D84.tmp.bat29⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2256"30⤵
-
-
C:\Windows\system32\find.exefind ":"30⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak30⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"30⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"31⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"28⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp55AF.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp55AF.tmp.bat28⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1752"29⤵
-
-
C:\Windows\system32\find.exefind ":"29⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak29⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"29⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"30⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"27⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5A60.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5A60.tmp.bat27⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2084"28⤵
-
-
C:\Windows\system32\find.exefind ":"28⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak28⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"28⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"29⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"26⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp562B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp562B.tmp.bat26⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2068"27⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"27⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak27⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"27⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"25⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5B0B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5B0B.tmp.bat25⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2748"26⤵
-
-
C:\Windows\system32\find.exefind ":"26⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak26⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"26⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"27⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"24⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp536D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp536D.tmp.bat24⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2304"25⤵
-
-
C:\Windows\system32\find.exefind ":"25⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak25⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"25⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"26⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"23⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp53CB.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp53CB.tmp.bat23⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2260"24⤵
-
-
C:\Windows\system32\find.exefind ":"24⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak24⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"24⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"22⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp48B4.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp48B4.tmp.bat22⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2132"23⤵
-
-
C:\Windows\system32\find.exefind ":"23⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak23⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"23⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"24⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"21⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp586E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp586E.tmp.bat21⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak22⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1284"22⤵
-
-
C:\Windows\system32\find.exefind ":"22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"20⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4CB9.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4CB9.tmp.bat20⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2372"21⤵
-
-
C:\Windows\system32\find.exefind ":"21⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak21⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"21⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"22⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"19⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5255.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5255.tmp.bat19⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1004"20⤵
-
-
C:\Windows\system32\find.exefind ":"20⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak20⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"20⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"21⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"18⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5216.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5216.tmp.bat18⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3000"19⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"19⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak19⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3000"19⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"19⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak19⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3000"19⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"19⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak19⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"19⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"20⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2992 -s 85217⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"16⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4D94.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4D94.tmp.bat16⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1160"17⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"17⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak17⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"17⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"18⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"15⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp49DC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp49DC.tmp.bat15⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2356"16⤵
-
-
C:\Windows\system32\find.exefind ":"16⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak16⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"16⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"17⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"14⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4D75.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4D75.tmp.bat14⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1988"15⤵
-
-
C:\Windows\system32\find.exefind ":"15⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1988"15⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"15⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak15⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"15⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"16⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"13⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4A49.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4A49.tmp.bat13⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2932"14⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"14⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak14⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"14⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"15⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4CC9.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4CC9.tmp.bat12⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2520"13⤵
-
-
C:\Windows\system32\find.exefind ":"13⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak13⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"14⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"11⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp53EA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp53EA.tmp.bat11⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1940"12⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"12⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak12⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"12⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"13⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"10⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp470E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp470E.tmp.bat10⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2496"11⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind ":"11⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak11⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"12⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5457.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5457.tmp.bat8⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak9⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2780"9⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"7⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp52D1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp52D1.tmp.bat7⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2656"8⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"8⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak8⤵
- Delays execution with timeout.exe
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"8⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"9⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp52C2.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp52C2.tmp.bat5⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2752"6⤵
-
-
C:\Windows\system32\find.exefind ":"6⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak6⤵
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"6⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"C:\Users\Admin\AppData\Local\Temp\STUB DO NOT RUN THISS.EXE"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "542382996-893712687-452265968-398736235-10885531618934022541794425350-1334389271"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-840220061-1903426685-20929525739829646641534311053-203990971620481628221561200267"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "72575231911959356371479975436295234976501817960-698651753-371287647-276275577"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8361498201225527859149069187480720086-972452708-821252673-44263638279360706"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8441018649404517436092208261235449482315776819106160621701791980-929929071"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2073149201164123992-1077615712-4430650141489736576-759339342463495028-750978335"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2113465937-1227151756-42992416519802469441451865913779502140-1586909827-941424321"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-823347876-6641092466509837275297675632011463913173607732-1406419305-638045736"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1804099053-740694610891056462-744564096-1988768148-467585623-2039713828-715469007"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD586de4e40528fd099ae01872b6af837cf
SHA1c616d8e3dc5643a15127dce69a327ce37a6b8ab8
SHA2567485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a
SHA512e9912f89c17ff6e7cd897d3256a2a4cd097090dcfee2a8dd85d98de0e618513efe8d3508cca5cbeb2711f27b4602c22cadd25f8eb1b417e7244da54a5db3a4c5
-
Filesize
198B
MD5645e44fab11a75b78ffe4459808cf1ff
SHA12923fcf08558fa94e4ab4beaa90b46b03e35f555
SHA2569503fbd75a773347ee1022206190bef2910bcf8728352dba5bc19c8f74a249cb
SHA512e00b833cf6e029817c29463ea70a3cd59998a2751f2e5930cc750daaae36656a4e1b301be83af3c2f22b51d266ae809a68f1f2ff35d8289f3d9943fc6d29aa0b
-
Filesize
136KB
-
Filesize
136KB