asyncrat | 89057bbeb5618835524cf8fc3a645fc5137553638520e763901fa1f2f8cdbe66

Analysis

max time kernel
59s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

2.1MB
MD5

084519881ac16c16cf9206f97a68f79e
SHA1

7b0fbc312ec9176a69ccb3036636e2423320cd79
SHA256

89057bbeb5618835524cf8fc3a645fc5137553638520e763901fa1f2f8cdbe66
SHA512

84b2867560cdbd3ca797196b208495631e49a87a2ea7451d6d68b52ea1ada0546c81d9b2e37b630440565cd53661c6541eb91c8bd662bb10780f87a7c7db5633
SSDEEP

49152:4ZZosvRgdkadC7i03aQAZutzArxizJZTrEbupmpVwMgc:4ZZostak7RGuqGJZXdpmIn

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

193.161.193.99:53757

Mutex

hsaurcrgqwhjimnkbht

Attributes

delay
1
install
true
install_file
Load.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000016ab9-13.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2304	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk	Done.exe

Executes dropped EXE 64 IoCs

pid	Process
2348	Done.exe
2196	Load.exe
2812	Done.exe
2908	Load.exe
1324	apihost.exe
1764	Done.exe
2636	Load.exe
284	Done.exe
548	Load.exe
1380	Load.exe
2960	Load.exe
696	Done.exe
1992	Load.exe
2836	Load.exe
2056	Done.exe
2800	Load.exe
2716	Done.exe
2064	Load.exe
2248	Load.exe
2996	Done.exe
2084	Load.exe
1860	Load.exe
2220	Done.exe
1016	Load.exe
2368	Load.exe
2984	Done.exe
968	Load.exe
2740	Load.exe
332	Load.exe
2752	Done.exe
1916	Load.exe
2904	Load.exe
1112	Done.exe
2728	Load.exe
380	Done.exe
1756	Load.exe
912	Load.exe
880	Done.exe
1676	Load.exe
892	Load.exe
1380	Done.exe
2024	Load.exe
1324	Load.exe
2592	Done.exe
1792	Load.exe
636	Load.exe
2248	Done.exe
548	Load.exe
1520	Load.exe
1264	Load.exe
1112	Done.exe
1104	Load.exe
2424	Done.exe
2184	Load.exe
1248	Load.exe
1528	Done.exe
1752	Load.exe
2740	Load.exe
2140	Done.exe
2848	Load.exe
2884	Load.exe
2764	Load.exe
2592	Done.exe
1488	Load.exe

Loads dropped DLL 2 IoCs

pid	Process
2348	Done.exe
2348	Done.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Done.exe

Delays execution with timeout.exe 26 IoCs

evasion

pid	Process
2380	timeout.exe
2824	timeout.exe
2664	timeout.exe
1560	timeout.exe
2560	timeout.exe
2060	timeout.exe
2820	timeout.exe
1924	timeout.exe
1532	timeout.exe
2724	timeout.exe
1260	timeout.exe
2108	timeout.exe
2236	timeout.exe
2064	timeout.exe
1740	timeout.exe
2464	timeout.exe
2756	timeout.exe
1016	timeout.exe
2112	timeout.exe
1612	timeout.exe
2364	timeout.exe
1688	timeout.exe
908	timeout.exe
2704	timeout.exe
2308	timeout.exe
1888	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe
1248	schtasks.exe
1956	schtasks.exe
2272	schtasks.exe
1028	schtasks.exe
2932	schtasks.exe
816	schtasks.exe
1692	schtasks.exe
2232	schtasks.exe
976	schtasks.exe
2548	schtasks.exe
448	schtasks.exe
1964	schtasks.exe
1168	schtasks.exe
1600	schtasks.exe
1608	schtasks.exe
1048	schtasks.exe
2388	schtasks.exe
1064	schtasks.exe
2472	schtasks.exe
2712	schtasks.exe
2940	schtasks.exe
3048	schtasks.exe
3068	schtasks.exe
2564	schtasks.exe
896	schtasks.exe
2324	schtasks.exe
896	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2812	Done.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2196	Load.exe
2196	Load.exe
2196	Load.exe
2304	powershell.exe
2908	Load.exe
2908	Load.exe
2908	Load.exe
2636	Load.exe
2636	Load.exe
2636	Load.exe
548	Load.exe
548	Load.exe
548	Load.exe
2960	Load.exe
2960	Load.exe
2960	Load.exe
2836	Load.exe
2836	Load.exe
2836	Load.exe
2064	Load.exe
2064	Load.exe
2064	Load.exe
2084	Load.exe
2084	Load.exe
2084	Load.exe
1016	Load.exe
1016	Load.exe
1016	Load.exe
968	Load.exe
968	Load.exe
968	Load.exe
332	Load.exe
332	Load.exe
332	Load.exe
2904	Load.exe
2904	Load.exe
2904	Load.exe
1756	Load.exe
1756	Load.exe
1756	Load.exe
1676	Load.exe
1676	Load.exe
1676	Load.exe
2024	Load.exe
2024	Load.exe
2024	Load.exe
1792	Load.exe
1792	Load.exe
1792	Load.exe
548	Load.exe
548	Load.exe
548	Load.exe
1264	Load.exe
1264	Load.exe
1264	Load.exe
2184	Load.exe
2184	Load.exe
2184	Load.exe
1752	Load.exe
1752	Load.exe
1752	Load.exe
2848	Load.exe
2848	Load.exe
2848	Load.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	Load.exe
Token: SeDebugPrivilege	2908	Load.exe
Token: SeDebugPrivilege	2348	Done.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2812	Done.exe
Token: SeDebugPrivilege	2636	Load.exe
Token: SeDebugPrivilege	548	Load.exe
Token: SeDebugPrivilege	1380	Load.exe
Token: SeDebugPrivilege	2960	Load.exe
Token: SeDebugPrivilege	1992	Load.exe
Token: SeDebugPrivilege	2836	Load.exe
Token: SeDebugPrivilege	2800	Load.exe
Token: SeDebugPrivilege	2064	Load.exe
Token: SeDebugPrivilege	2248	Load.exe
Token: SeDebugPrivilege	2084	Load.exe
Token: SeDebugPrivilege	1860	Load.exe
Token: SeDebugPrivilege	1016	Load.exe
Token: SeDebugPrivilege	2368	Load.exe
Token: SeDebugPrivilege	968	Load.exe
Token: SeDebugPrivilege	2740	Load.exe
Token: SeDebugPrivilege	332	Load.exe
Token: SeDebugPrivilege	1916	Load.exe
Token: SeDebugPrivilege	2904	Load.exe
Token: SeDebugPrivilege	2728	Load.exe
Token: SeDebugPrivilege	1756	Load.exe
Token: SeDebugPrivilege	912	Load.exe
Token: SeDebugPrivilege	1676	Load.exe
Token: SeDebugPrivilege	892	Load.exe
Token: SeDebugPrivilege	2024	Load.exe
Token: SeDebugPrivilege	1324	Load.exe
Token: SeDebugPrivilege	1792	Load.exe
Token: SeDebugPrivilege	636	Load.exe
Token: SeDebugPrivilege	548	Load.exe
Token: SeDebugPrivilege	1520	Load.exe
Token: SeDebugPrivilege	1264	Load.exe
Token: SeDebugPrivilege	1104	Load.exe
Token: SeDebugPrivilege	2184	Load.exe
Token: SeDebugPrivilege	1248	Load.exe
Token: SeDebugPrivilege	1752	Load.exe
Token: SeDebugPrivilege	2740	Load.exe
Token: SeDebugPrivilege	2848	Load.exe
Token: SeDebugPrivilege	2884	Load.exe
Token: SeDebugPrivilege	2764	Load.exe
Token: SeDebugPrivilege	1488	Load.exe
Token: SeDebugPrivilege	3064	Load.exe
Token: SeDebugPrivilege	2636	Load.exe
Token: SeDebugPrivilege	2236	Load.exe
Token: SeDebugPrivilege	1064	Load.exe
Token: SeDebugPrivilege	2436	Load.exe
Token: SeDebugPrivilege	2084	Load.exe
Token: SeDebugPrivilege	816	Load.exe
Token: SeDebugPrivilege	1016	Load.exe
Token: SeDebugPrivilege	2124	Load.exe
Token: SeDebugPrivilege	2744	Load.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2348	2244	Loader.exe	31
PID 2244 wrote to memory of 2348	2244	Loader.exe	31
PID 2244 wrote to memory of 2348	2244	Loader.exe	31
PID 2244 wrote to memory of 2348	2244	Loader.exe	31
PID 2244 wrote to memory of 2196	2244	Loader.exe	32
PID 2244 wrote to memory of 2196	2244	Loader.exe	32
PID 2244 wrote to memory of 2196	2244	Loader.exe	32
PID 2244 wrote to memory of 1272	2244	Loader.exe	33
PID 2244 wrote to memory of 1272	2244	Loader.exe	33
PID 2244 wrote to memory of 1272	2244	Loader.exe	33
PID 2196 wrote to memory of 2748	2196	Load.exe	34
PID 2196 wrote to memory of 2748	2196	Load.exe	34
PID 2196 wrote to memory of 2748	2196	Load.exe	34
PID 2196 wrote to memory of 2944	2196	Load.exe	35
PID 2196 wrote to memory of 2944	2196	Load.exe	35
PID 2196 wrote to memory of 2944	2196	Load.exe	35
PID 2748 wrote to memory of 2940	2748	cmd.exe	38
PID 2748 wrote to memory of 2940	2748	cmd.exe	38
PID 2748 wrote to memory of 2940	2748	cmd.exe	38
PID 2944 wrote to memory of 2756	2944	cmd.exe	39
PID 2944 wrote to memory of 2756	2944	cmd.exe	39
PID 2944 wrote to memory of 2756	2944	cmd.exe	39
PID 1272 wrote to memory of 2812	1272	Loader.exe	40
PID 1272 wrote to memory of 2812	1272	Loader.exe	40
PID 1272 wrote to memory of 2812	1272	Loader.exe	40
PID 1272 wrote to memory of 2812	1272	Loader.exe	40
PID 1272 wrote to memory of 2908	1272	Loader.exe	41
PID 1272 wrote to memory of 2908	1272	Loader.exe	41
PID 1272 wrote to memory of 2908	1272	Loader.exe	41
PID 1272 wrote to memory of 2596	1272	Loader.exe	42
PID 1272 wrote to memory of 2596	1272	Loader.exe	42
PID 1272 wrote to memory of 2596	1272	Loader.exe	42
PID 2348 wrote to memory of 2304	2348	Done.exe	43
PID 2348 wrote to memory of 2304	2348	Done.exe	43
PID 2348 wrote to memory of 2304	2348	Done.exe	43
PID 2348 wrote to memory of 2304	2348	Done.exe	43
PID 2348 wrote to memory of 3048	2348	Done.exe	45
PID 2348 wrote to memory of 3048	2348	Done.exe	45
PID 2348 wrote to memory of 3048	2348	Done.exe	45
PID 2348 wrote to memory of 3048	2348	Done.exe	45
PID 2348 wrote to memory of 1324	2348	Done.exe	47
PID 2348 wrote to memory of 1324	2348	Done.exe	47
PID 2348 wrote to memory of 1324	2348	Done.exe	47
PID 2348 wrote to memory of 1324	2348	Done.exe	47
PID 2908 wrote to memory of 1936	2908	Load.exe	48
PID 2908 wrote to memory of 1936	2908	Load.exe	48
PID 2908 wrote to memory of 1936	2908	Load.exe	48
PID 1936 wrote to memory of 896	1936	cmd.exe	50
PID 1936 wrote to memory of 896	1936	cmd.exe	50
PID 1936 wrote to memory of 896	1936	cmd.exe	50
PID 2596 wrote to memory of 1764	2596	Loader.exe	51
PID 2596 wrote to memory of 1764	2596	Loader.exe	51
PID 2596 wrote to memory of 1764	2596	Loader.exe	51
PID 2596 wrote to memory of 1764	2596	Loader.exe	51
PID 2596 wrote to memory of 2636	2596	Loader.exe	52
PID 2596 wrote to memory of 2636	2596	Loader.exe	52
PID 2596 wrote to memory of 2636	2596	Loader.exe	52
PID 2596 wrote to memory of 2260	2596	Loader.exe	53
PID 2596 wrote to memory of 2260	2596	Loader.exe	53
PID 2596 wrote to memory of 2260	2596	Loader.exe	53
PID 2908 wrote to memory of 572	2908	Load.exe	54
PID 2908 wrote to memory of 572	2908	Load.exe	54
PID 2908 wrote to memory of 572	2908	Load.exe	54
PID 572 wrote to memory of 1016	572	cmd.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\Done.exe
  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ACCApi'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe" /st 21:58 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- - C:\Users\Admin\AppData\Local\ACCApi\apihost.exe
    "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1324
- C:\Users\Admin\AppData\Local\Temp\Load.exe
  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2940
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD317.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2756
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Done.exe
    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Load.exe
    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:896
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDEFA.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1016
    - - C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
- - C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Done.exe
      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Load.exe
      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2636
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        5⤵
        
        PID:352
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1028
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE762.tmp.bat""
        5⤵
        
        PID:1680
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2560
      - C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:284
    - - C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        6⤵
        
        PID:2460
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2324
      - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpEF8D.tmp.bat""
        6⤵
        
        PID:2412
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:2112
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        7⤵
        
        PID:576
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF7B7.tmp.bat""
        7⤵
        
        PID:2332
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:2724
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        8⤵
        
        PID:2928
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpFFF1.tmp.bat""
        8⤵
        
        PID:3044
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        9⤵
        Delays execution with timeout.exe
        
        PID:1612
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        9⤵
        
        PID:3056
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2388
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A8.tmp.bat""
        9⤵
        
        PID:1028
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        10⤵
        Delays execution with timeout.exe
        
        PID:2236
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        10⤵
        
        PID:880
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1248
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp10E2.tmp.bat""
        10⤵
        
        PID:704
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        11⤵
        Delays execution with timeout.exe
        
        PID:908
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        9⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        11⤵
        
        PID:1728
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp191C.tmp.bat""
        11⤵
        
        PID:2096
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        12⤵
        Delays execution with timeout.exe
        
        PID:2704
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        10⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        12⤵
        
        PID:2940
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2194.tmp.bat""
        12⤵
        
        PID:2464
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        13⤵
        Delays execution with timeout.exe
        
        PID:2060
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        11⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        13⤵
        
        PID:2320
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1964
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp29CE.tmp.bat""
        13⤵
        
        PID:2692
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        14⤵
        Delays execution with timeout.exe
        
        PID:2308
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        12⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        14⤵
        
        PID:1052
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1168
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp32C4.tmp.bat""
        14⤵
        
        PID:1924
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        15⤵
        Delays execution with timeout.exe
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        13⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        15⤵
        
        PID:1660
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3A71.tmp.bat""
        15⤵
        
        PID:2108
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        16⤵
        Delays execution with timeout.exe
        
        PID:2064
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        14⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        16⤵
        
        PID:2492
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:976
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4347.tmp.bat""
        16⤵
        
        PID:2380
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        17⤵
        Delays execution with timeout.exe
        
        PID:2820
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        15⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        17⤵
        
        PID:816
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2548
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C4C.tmp.bat""
        17⤵
        
        PID:2736
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        18⤵
        Delays execution with timeout.exe
        
        PID:1740
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        16⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        18⤵
        
        PID:2656
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp53DA.tmp.bat""
        18⤵
        
        PID:2664
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        19⤵
        Delays execution with timeout.exe
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        17⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        19⤵
        
        PID:1032
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5C72.tmp.bat""
        19⤵
        
        PID:1604
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        20⤵
        Delays execution with timeout.exe
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        18⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        20⤵
        
        PID:756
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6558.tmp.bat""
        20⤵
        
        PID:2152
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        21⤵
        Delays execution with timeout.exe
        
        PID:1924
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        19⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        21⤵
        
        PID:920
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6D44.tmp.bat""
        21⤵
        
        PID:1356
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        22⤵
        Delays execution with timeout.exe
        
        PID:1260
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        20⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        22⤵
        
        PID:2512
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2272
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp758D.tmp.bat""
        22⤵
        
        PID:1532
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        23⤵
        Delays execution with timeout.exe
        
        PID:2380
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        21⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        23⤵
        
        PID:2552
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1608
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7DC7.tmp.bat""
        23⤵
        
        PID:1440
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        24⤵
        Delays execution with timeout.exe
        
        PID:2824
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        24⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        22⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        24⤵
        
        PID:2784
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:896
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp868E.tmp.bat""
        24⤵
        
        PID:2728
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        25⤵
        Delays execution with timeout.exe
        
        PID:2664
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        23⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        24⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        25⤵
        
        PID:2008
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8EF7.tmp.bat""
        25⤵
        
        PID:1804
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        26⤵
        Delays execution with timeout.exe
        
        PID:1688
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        26⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        24⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        26⤵
        
        PID:1780
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9702.tmp.bat""
        26⤵
        
        PID:2460
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        27⤵
        Delays execution with timeout.exe
        
        PID:1560
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        25⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        26⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        27⤵
        
        PID:2100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2232
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9F0D.tmp.bat""
        27⤵
        
        PID:2296
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        28⤵
        Delays execution with timeout.exe
        
        PID:2108
        
        C:\Users\Admin\AppData\Roaming\Load.exe
        
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        28⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        26⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        28⤵
        
        PID:2472
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2712
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA766.tmp.bat""
        28⤵
        
        PID:2932
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        29⤵
        Delays execution with timeout.exe
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        27⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Load.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        28⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        29⤵
        
        PID:2876
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        28⤵
        
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Done.exe

Filesize
69KB

MD5
2453fa8ef7ccc79cada8679f06f2be53

SHA1
b3db41bc85d300a069e6636b5c9e7dcf0a6a95b2

SHA256
e0e329ca03adcd56c5ff4a5cbdaff475a1cf636dfce64b7da1a05f5c74daac88

SHA512
a28398843232745153b3f57d2166aca95e9f930a8334c0ffdb2db192fc8cc8b2d5f5a0a0d123a996f2aa738668209a3541ffb9ed6f42f665aefb9300cd3d45d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Load.exe

Filesize
74KB

MD5
4fc5086bcb8939429aea99f7322e619b

SHA1
8d3bd7d005710a8ae0bd0143d18b437be20018d7

SHA256
e31d6dc4d6f89573321f389c5b3f12838545ff8d2f1380cfba1782d39853e9fd

SHA512
04e230f5b39356aecf4732ac9a2f4fea96e51018907e2f22c7e3f22e51188b64cdb3e202fe324f5e3500761fae43f898bf9489aa8faa34eff3566e1119a786d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp10E2.tmp.bat

Filesize
148B

MD5
172ff8498ef0d815c19bcf406e7900a9

SHA1
c06ccf06985eeb0e6e5886e0c5378288aea15902

SHA256
9e470c0cdcf9b4eeb030a84079f04dbe3e70f3591a9e5f7796d83a184f8e38aa

SHA512
9ee4a366f28c8c39d70d8a4e6cb62a6c9cf44053537cdaea806485da02d507c5b79f3c5297290e451dac82faccf47a7cca0a979b3acc2443d9deab8be0349b1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp191C.tmp.bat

Filesize
148B

MD5
3dee32d9762db6ff27c8bbbeffec6dc4

SHA1
fcc12f39a4f3378d7a8f0eb1dab4e5579e766447

SHA256
262d64aa91b0839cede5923269d9e4aab999fc088d1ee989ea9fc4d4b8c9c0e1

SHA512
60b823804753e8d793fdfd1db379fefff10201d640f93766b0747f96fcfe598548a78404e4f195fe30027874218c3b58d17669ab6c4192db7254628889239a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2194.tmp.bat

Filesize
148B

MD5
ad0ee51f1c8f984650311064fbe063eb

SHA1
4132bf9a89800d2656ed6d7896336837231ce529

SHA256
de373ebf704984e960b0ab622f2f5eb9f92721e968b8e7c273545ce4c52194a3

SHA512
b355c257a0c016acd44dcc1499e17e73c3b3e73e56114bf4db52fb621aff33a24d1a31acbaf9dbca3e74544a9f3d242d4d68e4a8560d861087914efa1bf6613e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp29CE.tmp.bat

Filesize
148B

MD5
b2c967ddce772f0531cfc41b55ed0d95

SHA1
b85011ddb11b352a687d0169a84c1aa47b36c0ff

SHA256
cd3de544b18bc85d2d41414efacb1646019a4041dfae802b9ac8d1959a936b35

SHA512
1f8ec051a890b8d35f0e834e71365ca333b5fdcb3ab1f89b8b238d6531ac43bda16f2bda2c10ab553f4e76bc726e2fa43163010f3d0d724bbdce82099bde39c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp32C4.tmp.bat

Filesize
148B

MD5
2c3a782d3071c6dd1789efdfea08af17

SHA1
8f9ceb7a5bc54df6eebd2b97658858c211aa282c

SHA256
de77676174fcd2d1b5e8523a84f3b96472332f36969409b3aadaf6542ae73f83

SHA512
2b2589a4157154948d9b3942363694d670fcdfdf4a5ac7606d4709966c3d24b253b60de6539e58484e2321554eb6555c977112b3d76d7ee0827aa936d8b732f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3A71.tmp.bat

Filesize
148B

MD5
83755b05803c4e98e00630d288453174

SHA1
ab3c59cba0a773035502c330530655d6033b3136

SHA256
9a6a5de59ef8977395ed8f75d88ffdd5b32b78df93f471d65b78e0d3199b416f

SHA512
dba6930e8312545637f38f9494dbccc9682fe76993e3607f3d9f46d7735d8049770f12ef3f2577b8cb5cc824715dc6e385f55e963e92184eaef6b327a9c99ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4347.tmp.bat

Filesize
148B

MD5
94eb63f38f741fb3f423e8195ae23495

SHA1
d1a3cfbc70ef37c4af0cfff77ea202a069ce447a

SHA256
bf669892f72c84c210d754b43bae0726ea1d711a1da7b673ba71a263ef2c35e6

SHA512
2228a74a9bba2bc947dad73d72aab722f96528e18d6e84bdf360aac1e68c40182b97a93b7a039cfea306f773bb6d6a2401befffd109bd737bdc015e2d9d23665

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C4C.tmp.bat

Filesize
148B

MD5
af75ba71b9c0ae584dac434648a9da04

SHA1
6e27c230731b50efd50119f01663d90462c5eee7

SHA256
d195474e81757dc18abbb297175b20b0f91e39dc6f7dfa29b54f7f8974a6f5cd

SHA512
78965314e2fd5bc674c0b22b5e12a7426131c9b7ce64f4bd02cd8f5a3fe14f3141738a848d95fd037501955cf6102511009306f9b806a2eeae6d73f7949e91f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53DA.tmp.bat

Filesize
148B

MD5
f713bad5497b8d385658d0cf477e42c9

SHA1
1e09192bd8a642d6f4576928c2e91fce54a744ae

SHA256
98ddac4a31ece383dd2377ff1475fd25ad07d0ac769be53add8ac6878f99f58c

SHA512
4f6035b374583533ed48fce987b1a8d3e9f66250a538b18ff948a2b3efd054c4355c095c6300ba0842b2a403fb1111431348282b57a4f42d00418158b0a815ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5C72.tmp.bat

Filesize
148B

MD5
119c351ceafc53c86f014b2afa6278a1

SHA1
9ae680a8f4574560330866fa3fdcae99efbe6f03

SHA256
880b40edeea6a186f11215ac9744fd605812dc83bf9fd9b523492fdfd6fb4c3d

SHA512
da809c666399ff05b6527fa2e93bec074e5458d3892caaed117de68cd9ce809b2acba24d7d0f4a1fc7884134102228bb1ae1aa59a476131dd87fb28f4b1747cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6558.tmp.bat

Filesize
148B

MD5
2dbf4ca61d86ca4777d962da9def0c14

SHA1
14fcf316c8b6af97c2cc5093a6bb6cb87dc604fe

SHA256
421a62039268193a1afb775ee9117d35bcb9f38d615611145ddb00aaf80a9f7c

SHA512
c1e2a270b5a04c7917959312f907776cb8641c92cb968bffe8ecd11ff86d49f03887b345e1a6557b1b74575c226271a02634eecfd18a65a36ef2f23dad10527c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6D44.tmp.bat

Filesize
148B

MD5
368ae5d8494bd6a4b342f28d05b9a188

SHA1
ac3f2f475513343489fc9a662c48712702243037

SHA256
0560ca065b36d9adacc7c1219386227f91c906e3bd739af1e1a4ee2e691bbca7

SHA512
133e091a4f039dde973bbbbe91ef8241d5a267fb09f9a1524e4529c430a76c7ada72bb7c955af575d6197514ccf8382514fc81a29f77ce4a27f4917f12a5d181

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp758D.tmp.bat

Filesize
148B

MD5
1d40c38f0f2464cffd3666adca0cccc4

SHA1
2da3000f502049db271a726b5f115ba621422157

SHA256
784ef0f5f3b52ce3f68801dd9bef03942f6a163fad7473cd90da0fb68d59fa5e

SHA512
5d9819aac3d3aa7d10bf4287ec3e0c57f72c8fe02266d8da8cd99304857a3d4d23fa20c1e310fe99d7990431c9f0ad943826c99f45747184bc20c5a10e582868

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7DC7.tmp.bat

Filesize
148B

MD5
c2457c44dcf65676f88ab08af423fb88

SHA1
0858a92719849110a11cd2711571656b0df03502

SHA256
b77f7db3d89d4dd522c9e62cbeffb095dba35fb5175b55289cfbbc09d66a5f6e

SHA512
ec88d2e54bf8a6f2914bac1553dbeb9d6e480eaab0e1f4f703eef885df3a6569680b7de89a7ca77a84e6fd51f70d237c7f016f24ad50eff2cafb52a65cf67d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp868E.tmp.bat

Filesize
148B

MD5
3f8318300b5acd8c4288aca1b754e387

SHA1
ea9681abca18564f894f02ba2b61ad53fa3a1a08

SHA256
34cba33cbd959bf745cec84d3bb6bd9dff4d1d3b33e6fe57eee5687b839b81b9

SHA512
2379d971535473a311a12bf12175f04a6fd362daa1991474cbe0187d09300e605ea9fcee9f3a8dfef63a81acf5266ee9eb0c61e26273a46cd714311fec152907

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8A8.tmp.bat

Filesize
147B

MD5
6aa7f6e5cd46e2da6be4620d6adb618e

SHA1
3e710771a69f28e6be44dfb1106654ae3f0d4905

SHA256
0755c5ea31c48f5795715dca0f2fbb819045d3ae71760117cf19105ba15bf851

SHA512
9263ef2488b4d710f72990556fc8a9ca80119be713e095e53a4cb5d149ee6dfb57695c2ce4434e4ca97429cf2b3d4a2363ba038074d1f20095ec468e2b87e1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8EF7.tmp.bat

Filesize
148B

MD5
92625b3a982d460646f2c10a2b6fd00c

SHA1
c18a3630c627f87b63fe58817d6bedbe33065396

SHA256
a864e89a874f7b9ca38b21d43c56ee75c9ad44b952f9cbd5ca9fe33efb2ee67c

SHA512
e4066248d00e8a7e63ef2d7b550f5c1b2a1c5ffcfa2a91a2e5ff12fa1be9a99508d394b5ab0dca7153087471c99d4c9d0d6bb10cedf1a1ceb138f86f2edcbb7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9702.tmp.bat

Filesize
148B

MD5
5ec827cf7946436116c75dc8daabc249

SHA1
0033fa00ee1ef64cc986f0a2d693fbd185468208

SHA256
1f718abffbaeb06a1c6547f521f4581e40830231c5b54053e09747483198bec3

SHA512
f82cca5ecb6fd87fc773d481da4bc8e1a9d47842f95080eb2495a40e517d66ffffe74f8f6f07a44d384824ec1d5a8c8b0dd3b145dc6f7a3a08f5b8b340fd1628

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9F0D.tmp.bat

Filesize
148B

MD5
d4bc8b9b6af3d41fa54cbaa5602bd2f4

SHA1
1244d3fbab265c75684af2e03b61f063c8a3a4c2

SHA256
8e5c6515e50b2bccf0e3fd898b9d20223a1b72285b43df7fe21cf85a2fcabbbe

SHA512
9eb9cdcfc69af7adda8e3814e5f1185a0a94efc17e9af268c5025c6febcf38dab1497dd0e04fdb77dafe49895b2f4cb231ef39ebc7279751ab16a1d3521daec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA766.tmp.bat

Filesize
148B

MD5
3d3523e09b33961e15a5b90631273610

SHA1
2ed162fa3e1677bc5c127c78ab1df1cb359aa721

SHA256
3bfb66de0028d5354d04c42a30013a37c491e82a3dac6e6704909b68241c519a

SHA512
ca32432cec0e3bb7f795020b897fa033bc842265220a4a75b4f34d60695efa78ab55bc9614463ba8c2f5096a51012a542046403c828a131a96bfc407cac13993

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD317.tmp.bat

Filesize
148B

MD5
ee3b83642b81c551e3ad1b7a202ed87f

SHA1
b9b100436a8bb8291764e7adca17a122e80c26d0

SHA256
279583aa1dbca39844238f81772cb9bdc0b17ff15028c3012932fa5b0929b66f

SHA512
8d61e32df2774f275bf080aa71e67a9844469d930edb64c6fb9c2b026befa2c171ce3f8e4b28766766aebab7f9f93b9bd7b294e57c648ad78cc01cb50b96f900

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDEFA.tmp.bat

Filesize
148B

MD5
888af5bc9a55e2f78ccae77d3295a6da

SHA1
53e019f422827cc8c238973c52877b471cf8d33e

SHA256
a66e4f3e3e7d3f742377539ce082e608374d0342d9cb7c554d55f5e0592bcc34

SHA512
2acafbbf114b037cfdee52b1b971137bc9adfcba40a8117e6683c0d78330edf927ffd895dca3e4de571bebeb37d437d0b2924d941a7032e6645f047535c44ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE762.tmp.bat

Filesize
148B

MD5
04832813191e47b9f4175df6ffb4b4b1

SHA1
5cc8ba97bcece884e4ecb8268114074a81dd88d8

SHA256
e543f9897afc2d7aedf261cf88870efc8b690afa0d74a6aabf7794e94f427119

SHA512
32722b80d7798d22dc63a148d9def8feb04eb82b526aaab0a301c21dda1eec0658580a251a7ad6509daa84ab9023f1a2c057658bd64e705078548d65f4eca891

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF8D.tmp.bat

Filesize
148B

MD5
cc5f7190a4b4937c0c927eec372fd38a

SHA1
30d370fe1083b372774abdd0df94318bdec0ff43

SHA256
16756e41c2dc1f8bb69387e207a92d0917cc2cedf34607f09da9b94ff92a526d

SHA512
4e07a0a6037eab97d6b7971bfc77e96c494831609fbbb97ee502563ce76a15bddddfe13702575ddd6db9c36815c07368ceef22d2ce8d1d883db819597ed94c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF7B7.tmp.bat

Filesize
148B

MD5
e86827a44a4a656d2ad2a2930bd868c3

SHA1
6fbff7943efe4dee68519c29a90053ab457fc3bb

SHA256
621f6df3c7c5343ea07b5f66e2873d30d28a3709fc8c7a53f9db8235978af3ba

SHA512
4b3384f3a424507dadea0efaade121fa7c6b67ab076e4167357641b9f30797dcb958237ddfaf633141bab331c4f13a4437035755bb5a5d2d0310d5dcc3d9bd3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFFF1.tmp.bat

Filesize
148B

MD5
0168d3a1c3f29200bd883d7acc4be362

SHA1
ce3944f87df5a6de6bc43bd93dec51fa19eb48c7

SHA256
9ea69961c2f35717fc19a3769590b171f50a312e59e94367d6524f079a28fd95

SHA512
41baa1f31f022feb38365ad87eab08840cb0f70e7c42af17cf143bcb6bf7faa03c3c6adfb024216eef2ac25a23b8ae6eb806c895fd0d5f4dc28d0dbef9ba7cc8

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
memory/636-232-0x00000000009F0000-0x0000000000A08000-memory.dmp

Filesize
96KB

Download
memory/892-212-0x00000000001F0000-0x0000000000208000-memory.dmp

Filesize
96KB

Download
memory/912-202-0x00000000012E0000-0x00000000012F8000-memory.dmp

Filesize
96KB

Download
memory/1016-331-0x00000000000E0000-0x00000000000F8000-memory.dmp

Filesize
96KB

Download
memory/1064-311-0x0000000000EC0000-0x0000000000ED8000-memory.dmp

Filesize
96KB

Download
memory/1104-252-0x0000000000360000-0x0000000000378000-memory.dmp

Filesize
96KB

Download
memory/1248-262-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download
memory/1324-46-0x0000000000C40000-0x0000000000C58000-memory.dmp

Filesize
96KB

Download
memory/1324-222-0x0000000000820000-0x0000000000838000-memory.dmp

Filesize
96KB

Download
memory/1380-76-0x0000000001040000-0x0000000001058000-memory.dmp

Filesize
96KB

Download
memory/1488-292-0x00000000012C0000-0x00000000012D8000-memory.dmp

Filesize
96KB

Download
memory/1520-242-0x0000000000B20000-0x0000000000B38000-memory.dmp

Filesize
96KB

Download
memory/1860-137-0x0000000000910000-0x0000000000928000-memory.dmp

Filesize
96KB

Download
memory/1916-182-0x0000000001360000-0x0000000001378000-memory.dmp

Filesize
96KB

Download
memory/1992-91-0x00000000010A0000-0x00000000010B8000-memory.dmp

Filesize
96KB

Download
memory/2084-321-0x0000000001380000-0x0000000001398000-memory.dmp

Filesize
96KB

Download
memory/2196-14-0x0000000000C60000-0x0000000000C78000-memory.dmp

Filesize
96KB

Download
memory/2244-16-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2244-10-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2244-1-0x0000000001050000-0x0000000001274000-memory.dmp

Filesize
2.1MB

Download
memory/2244-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/2248-122-0x0000000000930000-0x0000000000948000-memory.dmp

Filesize
96KB

Download
memory/2348-17-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/2368-152-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/2728-192-0x00000000002A0000-0x00000000002B8000-memory.dmp

Filesize
96KB

Download
memory/2740-167-0x0000000000F00000-0x0000000000F18000-memory.dmp

Filesize
96KB

Download
memory/2740-272-0x00000000009E0000-0x00000000009F8000-memory.dmp

Filesize
96KB

Download
memory/2744-341-0x0000000000830000-0x0000000000848000-memory.dmp

Filesize
96KB

Download
memory/2800-106-0x0000000001150000-0x0000000001168000-memory.dmp

Filesize
96KB

Download
memory/2884-282-0x0000000001180000-0x0000000001198000-memory.dmp

Filesize
96KB

Download
memory/2908-33-0x0000000000A40000-0x0000000000A58000-memory.dmp

Filesize
96KB

Download