quasar | e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587

Analysis

max time kernel
553s
max time network
546s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

749286088524b5c49a9f6fd5dd15de49
SHA1

bc255bc2f5a7f50e8fec2e5eca55c82de0bb15a2
SHA256

e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587
SHA512

b0ac4798d04e443f6e795e718bf301a885bc96ab2bd12f4d2b14d47e75aa897b5f53c22dab14b95a12a4f2e177d86a78a0af08ab916906a9a9ce7eb0b860dd8e
SSDEEP

49152:WvWI22SsaNYfdPBldt698dBcjHSlRJ6ibR3LoGd09THHB72eh2NT:Wv722SsaNYfdPBldt6+dBcjHSlRJ6c

Score

10^/10

quasar kdotcrypt discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KDOTCrypt

fedx.ddns.net:7000

Mutex

f70e50c5-1467-4cc3-8be1-b4ca15c11c35

Attributes

encryption_key
92470F4731518ABFA77DC89068544FB7E7B7C459
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/1768-1-0x0000000000F00000-0x0000000001224000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 53 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 53 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3712	PING.EXE
3272	PING.EXE
3268	PING.EXE
1176	PING.EXE
4444	PING.EXE
1544	PING.EXE
1424	PING.EXE
540	PING.EXE
2300	PING.EXE
536	PING.EXE
3860	PING.EXE
3024	PING.EXE
1884	PING.EXE
2164	PING.EXE
3644	PING.EXE
2280	PING.EXE
5112	PING.EXE
1536	PING.EXE
2384	PING.EXE
3128	PING.EXE
1668	PING.EXE
3216	PING.EXE
1848	PING.EXE
1536	PING.EXE
4192	PING.EXE
3480	PING.EXE
2956	PING.EXE
4536	PING.EXE
2368	PING.EXE
3272	PING.EXE
904	PING.EXE
2776	PING.EXE
2348	PING.EXE
968	PING.EXE
1880	PING.EXE
2956	PING.EXE
3676	PING.EXE
2628	PING.EXE
3964	PING.EXE
4880	PING.EXE
4500	PING.EXE
4456	PING.EXE
4808	PING.EXE
4656	PING.EXE
2272	PING.EXE
2740	PING.EXE
1452	PING.EXE
3652	PING.EXE
4500	PING.EXE
2560	PING.EXE
4556	PING.EXE
3196	PING.EXE
2108	PING.EXE

Runs ping.exe 1 TTPs 53 IoCs

Remote System Discovery

T1018

pid	Process
4500	PING.EXE
904	PING.EXE
4808	PING.EXE
2300	PING.EXE
3272	PING.EXE
3676	PING.EXE
1668	PING.EXE
3480	PING.EXE
3268	PING.EXE
2956	PING.EXE
2108	PING.EXE
4656	PING.EXE
2384	PING.EXE
1544	PING.EXE
4456	PING.EXE
2560	PING.EXE
1536	PING.EXE
1848	PING.EXE
4192	PING.EXE
2272	PING.EXE
2628	PING.EXE
3860	PING.EXE
3128	PING.EXE
968	PING.EXE
536	PING.EXE
4556	PING.EXE
3272	PING.EXE
3964	PING.EXE
3216	PING.EXE
540	PING.EXE
2956	PING.EXE
4880	PING.EXE
3712	PING.EXE
3644	PING.EXE
2164	PING.EXE
1536	PING.EXE
4500	PING.EXE
4536	PING.EXE
1452	PING.EXE
3196	PING.EXE
5112	PING.EXE
3024	PING.EXE
1176	PING.EXE
4444	PING.EXE
2348	PING.EXE
2280	PING.EXE
2776	PING.EXE
2368	PING.EXE
1880	PING.EXE
1424	PING.EXE
1884	PING.EXE
3652	PING.EXE
2740	PING.EXE

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	Client-built.exe
Token: SeDebugPrivilege	700	Client-built.exe
Token: SeDebugPrivilege	952	Client-built.exe
Token: SeDebugPrivilege	3240	Client-built.exe
Token: SeDebugPrivilege	2220	Client-built.exe
Token: SeDebugPrivilege	3668	Client-built.exe
Token: SeDebugPrivilege	632	Client-built.exe
Token: SeDebugPrivilege	3516	Client-built.exe
Token: SeDebugPrivilege	796	Client-built.exe
Token: SeDebugPrivilege	3240	Client-built.exe
Token: SeDebugPrivilege	1072	Client-built.exe
Token: SeDebugPrivilege	1648	Client-built.exe
Token: SeDebugPrivilege	1028	Client-built.exe
Token: SeDebugPrivilege	1840	Client-built.exe
Token: SeDebugPrivilege	3728	Client-built.exe
Token: SeDebugPrivilege	4128	Client-built.exe
Token: SeDebugPrivilege	1744	Client-built.exe
Token: SeDebugPrivilege	2464	Client-built.exe
Token: SeDebugPrivilege	1076	Client-built.exe
Token: SeDebugPrivilege	1832	Client-built.exe
Token: SeDebugPrivilege	4620	Client-built.exe
Token: SeDebugPrivilege	2060	Client-built.exe
Token: SeDebugPrivilege	1884	Client-built.exe
Token: SeDebugPrivilege	4404	Client-built.exe
Token: SeDebugPrivilege	1228	Client-built.exe
Token: SeDebugPrivilege	1512	Client-built.exe
Token: SeDebugPrivilege	1156	Client-built.exe
Token: SeDebugPrivilege	5052	Client-built.exe
Token: SeDebugPrivilege	1772	Client-built.exe
Token: SeDebugPrivilege	4576	Client-built.exe
Token: SeDebugPrivilege	4084	Client-built.exe
Token: SeDebugPrivilege	4572	Client-built.exe
Token: SeDebugPrivilege	5064	Client-built.exe
Token: SeDebugPrivilege	3144	Client-built.exe
Token: SeDebugPrivilege	2136	Client-built.exe
Token: SeDebugPrivilege	2512	Client-built.exe
Token: SeDebugPrivilege	2104	Client-built.exe
Token: SeDebugPrivilege	4112	Client-built.exe
Token: SeDebugPrivilege	4496	Client-built.exe
Token: SeDebugPrivilege	3036	Client-built.exe
Token: SeDebugPrivilege	3096	Client-built.exe
Token: SeDebugPrivilege	2176	Client-built.exe
Token: SeDebugPrivilege	1908	Client-built.exe
Token: SeDebugPrivilege	2336	Client-built.exe
Token: SeDebugPrivilege	1424	Client-built.exe
Token: SeDebugPrivilege	2012	Client-built.exe
Token: SeDebugPrivilege	1496	Client-built.exe
Token: SeDebugPrivilege	4468	Client-built.exe
Token: SeDebugPrivilege	4860	Client-built.exe
Token: SeDebugPrivilege	4780	Client-built.exe
Token: SeDebugPrivilege	4840	Client-built.exe
Token: SeDebugPrivilege	1212	Client-built.exe
Token: SeDebugPrivilege	2060	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 3088	1768	Client-built.exe	83
PID 1768 wrote to memory of 3088	1768	Client-built.exe	83
PID 3088 wrote to memory of 2772	3088	cmd.exe	85
PID 3088 wrote to memory of 2772	3088	cmd.exe	85
PID 3088 wrote to memory of 3480	3088	cmd.exe	86
PID 3088 wrote to memory of 3480	3088	cmd.exe	86
PID 3088 wrote to memory of 700	3088	cmd.exe	95
PID 3088 wrote to memory of 700	3088	cmd.exe	95
PID 700 wrote to memory of 3556	700	Client-built.exe	97
PID 700 wrote to memory of 3556	700	Client-built.exe	97
PID 3556 wrote to memory of 1852	3556	cmd.exe	99
PID 3556 wrote to memory of 1852	3556	cmd.exe	99
PID 3556 wrote to memory of 2776	3556	cmd.exe	100
PID 3556 wrote to memory of 2776	3556	cmd.exe	100
PID 3556 wrote to memory of 952	3556	cmd.exe	106
PID 3556 wrote to memory of 952	3556	cmd.exe	106
PID 952 wrote to memory of 368	952	Client-built.exe	108
PID 952 wrote to memory of 368	952	Client-built.exe	108
PID 368 wrote to memory of 4456	368	cmd.exe	110
PID 368 wrote to memory of 4456	368	cmd.exe	110
PID 368 wrote to memory of 1424	368	cmd.exe	111
PID 368 wrote to memory of 1424	368	cmd.exe	111
PID 368 wrote to memory of 3240	368	cmd.exe	115
PID 368 wrote to memory of 3240	368	cmd.exe	115
PID 3240 wrote to memory of 5084	3240	Client-built.exe	117
PID 3240 wrote to memory of 5084	3240	Client-built.exe	117
PID 5084 wrote to memory of 4820	5084	cmd.exe	119
PID 5084 wrote to memory of 4820	5084	cmd.exe	119
PID 5084 wrote to memory of 3644	5084	cmd.exe	120
PID 5084 wrote to memory of 3644	5084	cmd.exe	120
PID 5084 wrote to memory of 2220	5084	cmd.exe	123
PID 5084 wrote to memory of 2220	5084	cmd.exe	123
PID 2220 wrote to memory of 3988	2220	Client-built.exe	125
PID 2220 wrote to memory of 3988	2220	Client-built.exe	125
PID 3988 wrote to memory of 1228	3988	cmd.exe	127
PID 3988 wrote to memory of 1228	3988	cmd.exe	127
PID 3988 wrote to memory of 3268	3988	cmd.exe	128
PID 3988 wrote to memory of 3268	3988	cmd.exe	128
PID 3988 wrote to memory of 3668	3988	cmd.exe	129
PID 3988 wrote to memory of 3668	3988	cmd.exe	129
PID 3668 wrote to memory of 1028	3668	Client-built.exe	131
PID 3668 wrote to memory of 1028	3668	Client-built.exe	131
PID 1028 wrote to memory of 1588	1028	cmd.exe	133
PID 1028 wrote to memory of 1588	1028	cmd.exe	133
PID 1028 wrote to memory of 2956	1028	cmd.exe	134
PID 1028 wrote to memory of 2956	1028	cmd.exe	134
PID 1028 wrote to memory of 632	1028	cmd.exe	136
PID 1028 wrote to memory of 632	1028	cmd.exe	136
PID 632 wrote to memory of 1840	632	Client-built.exe	138
PID 632 wrote to memory of 1840	632	Client-built.exe	138
PID 1840 wrote to memory of 4048	1840	cmd.exe	140
PID 1840 wrote to memory of 4048	1840	cmd.exe	140
PID 1840 wrote to memory of 4536	1840	cmd.exe	141
PID 1840 wrote to memory of 4536	1840	cmd.exe	141
PID 1840 wrote to memory of 3516	1840	cmd.exe	143
PID 1840 wrote to memory of 3516	1840	cmd.exe	143
PID 3516 wrote to memory of 3628	3516	Client-built.exe	145
PID 3516 wrote to memory of 3628	3516	Client-built.exe	145
PID 3628 wrote to memory of 3504	3628	cmd.exe	147
PID 3628 wrote to memory of 3504	3628	cmd.exe	147
PID 3628 wrote to memory of 3024	3628	cmd.exe	148
PID 3628 wrote to memory of 3024	3628	cmd.exe	148
PID 3628 wrote to memory of 796	3628	cmd.exe	150
PID 3628 wrote to memory of 796	3628	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fj4KBipi3H96.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2772
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Btor9ImCHGnY.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1852
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vx8oYq8eLlS7.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4456
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rAiIPgehFV3l.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RoRoTAqoH6OG.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eeTQRJjxFccb.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1588
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fsa5gjnQyp69.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4048
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rx06UKRcIu3X.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8JxJwDhqq1fi.bat" "
        18⤵
        
        PID:3740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:1132
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W1CVkhsfHM0R.bat" "
        20⤵
        
        PID:4420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Tnnsa6uKo3XS.bat" "
        22⤵
        
        PID:2220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4YZLmJjgg5qN.bat" "
        24⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKVA4DqfqPmY.bat" "
        26⤵
        
        PID:4864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:5112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MK2AVE9VHKMG.bat" "
        28⤵
        
        PID:1416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9xhJpicgudRh.bat" "
        30⤵
        
        PID:3628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4156
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ePtWK1T1Au5N.bat" "
        32⤵
        
        PID:4772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:332
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rWj1mFqf0DCa.bat" "
        34⤵
        
        PID:1980
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:3596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        35⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GDPycotHpUEX.bat" "
        36⤵
        
        PID:3672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        37⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6dNJp4GNJqZ1.bat" "
        38⤵
        
        PID:3668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:4800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        39⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eojDj1pSesxw.bat" "
        40⤵
        
        PID:4624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:2120
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        41⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEzCnPmc4STL.bat" "
        42⤵
        
        PID:1592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:3556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        43⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LuS1SHsf75kT.bat" "
        44⤵
        
        PID:3152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        45⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rexj9lZ6zF01.bat" "
        46⤵
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:3644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        47⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kBMiA6qsUO3I.bat" "
        48⤵
        
        PID:4236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:1464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        49⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HDViU1pQ9ois.bat" "
        50⤵
        
        PID:1144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        51⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l1TqRd2V9zLF.bat" "
        52⤵
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        53⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wbsPHRKsvg9r.bat" "
        54⤵
        
        PID:3128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        55⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GLg0JkmhY16x.bat" "
        56⤵
        
        PID:952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        57⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anRdXWjCxZ6k.bat" "
        58⤵
        
        PID:4640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        59⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QmK6BgQyVqUG.bat" "
        60⤵
        
        PID:5068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:2308
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        61⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKMpGujUR683.bat" "
        62⤵
        
        PID:1744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        63⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Vyf4rPcBmnl.bat" "
        64⤵
        
        PID:3096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:1228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        65⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dowb8JJAbNQt.bat" "
        66⤵
        
        PID:3168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:2560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        67⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7sAUJaAOEpya.bat" "
        68⤵
        
        PID:4484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:3788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        69⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cHZp7zVmJp2o.bat" "
        70⤵
        
        PID:3092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:3388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        71⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4TwzqrgYtuMe.bat" "
        72⤵
        
        PID:4456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:1932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        73⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        73⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqffD50UkymV.bat" "
        74⤵
        
        PID:2764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:2696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        75⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        75⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QM9EtjyS0MFg.bat" "
        76⤵
        
        PID:812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:4928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        77⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        77⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeoNkhvbYq52.bat" "
        78⤵
        
        PID:1464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:3664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        79⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        79⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asIOWte6am6N.bat" "
        80⤵
        
        PID:396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:4152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        81⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        81⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7sqX7onwM7Rw.bat" "
        82⤵
        
        PID:3672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:2560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        83⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        83⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VkmxuKDPrcob.bat" "
        84⤵
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:2408
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        85⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        85⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZX2tcpuPuVNW.bat" "
        86⤵
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:1952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        87⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        87⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ORBSIqwHfdJp.bat" "
        88⤵
        
        PID:4620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:5060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        89⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        89⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ETFGZIwz1ND4.bat" "
        90⤵
        
        PID:2168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:216
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        91⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        91⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i7HKkqBJo8Vw.bat" "
        92⤵
        
        PID:664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:4904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        93⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        93⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ixyWl3e3Khv9.bat" "
        94⤵
        
        PID:1860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:3652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        95⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        95⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SnI369T4OAS6.bat" "
        96⤵
        
        PID:224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:2724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        97⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        97⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u8c6kN7ObX3n.bat" "
        98⤵
        
        PID:1900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:2224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        99⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        99⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYqvd8XDnmsi.bat" "
        100⤵
        
        PID:2580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:1736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        101⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        101⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ilaS5Ttm91Td.bat" "
        102⤵
        
        PID:5040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:4596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        103⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        103⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RedBBgwy7auY.bat" "
        104⤵
        
        PID:1332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:2556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        105⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        105⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U5dJTpZ5m1HB.bat" "
        106⤵
        
        PID:3432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:2708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        107⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4TwzqrgYtuMe.bat

Filesize
209B

MD5
43df015d9809b23dc6ee6d50950fec87

SHA1
edde70fe6b1779bb1aa8e1d3e727a9ead117f23d

SHA256
eb0c811a5e0f566ceaf6ee77645fe47d48b30661dba87f274d5b3b0a358d914e

SHA512
0f8957f3a18440ce189e4253f15b43fb25e6236799ad4200d4ad05b71452ff789a0a23b029efdc66b5cfd71db2d760f99d754b59013f35256791f839528b6a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\4YZLmJjgg5qN.bat

Filesize
209B

MD5
2d3210594ac1d54cbd09ad4632125f3c

SHA1
18fe2419beb73e205c56c80414d180325e4ce456

SHA256
a19b4983ee38ed3829209a3f3e08a3d3d74cbf95cc45d56a9170cd2583fe0257

SHA512
cbd2735254315f0b542d18551761b90ba73c8bc27f83cc3170d56ced791206cd36d729a11e796c50cbce1f52642191c5d6f235fa2a99ebaf21acb108dba417f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Vyf4rPcBmnl.bat

Filesize
209B

MD5
3afc1b7dc31eb37ec90dfc8b1e793650

SHA1
05fd23c77b0994415914b6a4385aa470776f7b08

SHA256
299f0acbb751055ffff9104faad3d66e28ae35e5b1a5128eb4a7f6055a2d672a

SHA512
13618d7869372f6df345f9af49bf8ccfc524f7a3563845585f6c26686b5538cb44d14135c22f094554e72b276de69fd7ba77c1fb250cf5f6450ca1b8e0a17f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dNJp4GNJqZ1.bat

Filesize
209B

MD5
89b37b44531d183d0749ee99c661e9a5

SHA1
e12ede601e2842dd9c14dc7773822892bac1a8f2

SHA256
0fd50d433734a1e24d781ac56743020fa09bc29bf2b81c745e93448c4a1790bc

SHA512
4fafa7fb8843929590cfa3dfa78732d09774125ce86844034d4ed63ecd4184fe475edda637890472194de042758438e9f0ac77bd9337484eeb4b1099bf96d406

Download Submit
C:\Users\Admin\AppData\Local\Temp\7sAUJaAOEpya.bat

Filesize
209B

MD5
be2b7ad839eb1b02558329b58e8ed441

SHA1
21c19983643b628aeaff99203dad8787d699ea6a

SHA256
fb026256d6fa58de88c3e3b5c1655ba2c774a8b0427b1dab7c9fd427ebd7e41f

SHA512
6a77adb1cb31598cf5122aee9f11ba0b2f47e7c3c59654a823dd926f881d60a6e7dc203f68e8bb3975993f0e20ab4c7098a713fd18cf5d863433f643d110558c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7sqX7onwM7Rw.bat

Filesize
209B

MD5
63e61286c0ec4e5af1f1495219f14d90

SHA1
734399c5903fc3516f749acd785d2f3f3c176e4a

SHA256
4388be6eefc0c2a7615087364a3d78bbc187a4f1ba0809ef697f19a5170df472

SHA512
afb20935b2386c62936b3e273e5adf3e368749d1ba44a3eb4d4e12f1fc0b99912de9c81baba3a262b442aef212e933ce74942dfaf8b15f4fbeb91258d38c7306

Download Submit
C:\Users\Admin\AppData\Local\Temp\8JxJwDhqq1fi.bat

Filesize
209B

MD5
8f5d9ebbcc86bc8c5a2fcefb0e5b91a8

SHA1
e296658f11360a9a943ffde3dc3cb3373e77edaa

SHA256
f19a7204a205967d344a56f4a21259ca16f08e037258bf41e17fff40582058ab

SHA512
63c50ef80463b83baea85b6893aa967d670b02275de214d107cd5773905d3145c77cf571be84398e56da6756d7b161f600dc8f435803a04ae06f8d6ef5e8921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9xhJpicgudRh.bat

Filesize
209B

MD5
19727b7f2fb089ba3df9363bcb443e84

SHA1
8ebefef76c39c9eca96008a6991384b334f8c93b

SHA256
8494da318947eeb034e80d14ae982d790999cdeb1a5ba64b2b1fe6018aee0d68

SHA512
64e6bfe7dc80149014c384def86815531fbd4d103bdd4fb5345911c42174e375230353cae5e666a7d4fab326971a14a11aed732e7aa06bb58241b7c1b2f5c76b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Btor9ImCHGnY.bat

Filesize
209B

MD5
c08bb1095b41b2c4e8c36729cdda6542

SHA1
01d301ce7b01662ccf77d3f61e368923febfbc27

SHA256
1d782e6f5a9872d0dbefacc3b45297df5fec091decc2a0858be97dc310334054

SHA512
ee992ba2315badd0e5d368653a6fe3aee109c43a1e5c4ad2e1ce3693d313266e3de964a4564daa293f5dc158a17a57e31d45993502b4696507cf8b6198e82296

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dowb8JJAbNQt.bat

Filesize
209B

MD5
5ba6a1be6b6daa1ed13cd5036377021d

SHA1
4c297fd07b934d09a3e23f91c89e1a2e39a58d15

SHA256
52566bb66ac558cd70d2670300bd86a65a25f4d9ad02a9ff2789c415587f687a

SHA512
c753b3d56f3f052a94fc7c068497ce9d89fa13993614ff0451fd5195c52cf92aee858fcc0a9d939e5ac7d2254a8fff1304ba3c3ceb4831a589921c3abebb8e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEzCnPmc4STL.bat

Filesize
209B

MD5
fd0d545d3f8652b2f8b3703f9b8338d0

SHA1
ac5f5e8aaa31fd9b93c13585ebca4dbfdc6e8522

SHA256
bb401ad7d7385a7ef3fd04078baba1941c72d92d8bb124afcd708149484953fe

SHA512
4fa1f1e1df092085a38951c86772fa4ed257ab577922a00586b6ea82ccba197031653578348929d361ee32a40881762de1d48cbb6ae2dd2dd1f79a9a650f3b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\ETFGZIwz1ND4.bat

Filesize
209B

MD5
91c269426a98de92a9ba38996020c843

SHA1
07f0279c58f1319d93fdcec72595ce09a1c9b9d9

SHA256
b9786bec78e52a9fe95f53c828f587326caae8ab736e05271fe226568cd52fd4

SHA512
92cde6b7ee2ae069199482a2a051c7d0949d938dc9cb00fc25129c63d24862f60c105c436b1f6ed0d8bd7a708fd49b4b1c2d9992450cdb353af673086e383d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fsa5gjnQyp69.bat

Filesize
209B

MD5
fbfe756d511a34e650a8650bac33b436

SHA1
bccba80ec4173a5cb5310aa866b072a12c18f39a

SHA256
1f5400569824539b3523ba1505f762e914e3e57bff741042558f0a81964e1d31

SHA512
cc276aa91d2cd193273931ec30ba096ddc2e325038a7df7337681646f4ff931f6ebfcbc8a6395427e1c3a322a1b7881cb0f9c83c762430922355115ee8444c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\GDPycotHpUEX.bat

Filesize
209B

MD5
e119c1f3a3fe768a5fdbdc61e7ddc1e8

SHA1
02b6819b125da5ca2882503ed442c3f1beb5f1a7

SHA256
6a6d2f9a97fe1736bd41f4f52c83f54ad918301c7aeeb77d72a7ef174267cd47

SHA512
5aef576cca4ce0d0de2d58240605feb55fe3bf98476a8d33ce11032345226575a7e0419926f8451319153bbb648405a411b7a6093c6c905df5f875c60583110e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLg0JkmhY16x.bat

Filesize
209B

MD5
3ea559267c53aa0256e17b0b567a7134

SHA1
9ce55b4eaf8d0bd01fdcf5955a4dc727e81f8a80

SHA256
2af6f873464adf75f387833adf9e22299bd2d2c1640fdf5ea992b8e50962a5f0

SHA512
01886579ff29169a16d071b7e40b22368556081183f96feb7778e50047c4f7ab8a14df7997a52af45c1563835aff2f7cd3217697455c6bd0586d08e48adf615f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HDViU1pQ9ois.bat

Filesize
209B

MD5
54adffecd5ce20b94b6534377584c683

SHA1
828729720ff744883bd9bee5ef070fb3bef6594a

SHA256
6f80c186edb07f1c6cb14569ffcbf09db0597f58a305a295f5e7c017ff94c728

SHA512
e79796e3f059e07d81cbe6d3d907440b825f00b1cd746ec25112afee8f075fbc16f6ccbe00b9fdcc032cfac0945c66291b2203e6ac8d0eef7a4d1c9126f277e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\HqffD50UkymV.bat

Filesize
209B

MD5
3f01a4a7dcfd3fd8255814aa2f88d8ee

SHA1
76f0610c0e70855e5b080da45dfcece729a784b6

SHA256
095019158c551f4a5158867143bdeda7213ac9bb9f366a93b2718e8d3b608345

SHA512
c205224e78de37534892b5fa51f10492725182fbf6e869e4bb5272db3063c86d9e781075d4e9c72d4971fbd3772e064a7f2cf7b04ccd2877bb268ab67edc96d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\JYqvd8XDnmsi.bat

Filesize
209B

MD5
5ba3fe787f307560b5dc2a7da404a285

SHA1
40869849092539a9f1e373153e5081f57a6a41a3

SHA256
ea58c8395ff27946f8273bc5ac8a05578c6dbe952bd2762c819501c554ff39f8

SHA512
6d51a0896af4bce357f23c20d84dcc39c0964e125711f765c7e3c5d128ddbc34bb641b048f66209ccc860d0b798f486338dcc8faf659ae060746eb1cb7bd4247

Download Submit
C:\Users\Admin\AppData\Local\Temp\LeoNkhvbYq52.bat

Filesize
209B

MD5
3fa0819ffa46e579b5060e4fc4088178

SHA1
aada0d0304fb3ece2be0d86fc4894435fe432508

SHA256
47f198083d1dee5b765872d15261253cb02419b6bbd506ba12da5e44b97a08b1

SHA512
c62280adaf41939ada2f8dc4cad9852a279880bc2cb9bceba4e5ee1237662118dd906c583e7307a03acda231116c1a0c289816efb272a28348e84d01bdc34cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuS1SHsf75kT.bat

Filesize
209B

MD5
9f148f011f09303f126aa1671c61421f

SHA1
53802ba3b93ac44c804bf117c482575ec4a53f4c

SHA256
d4d513461fd5d70df51b5fff86db2086ca01a9fdba7650fc933f91fcea08988f

SHA512
b138f0bad3b586b54049abd2ce1f14928e06167046df96170740b7a35fbf328423c911136d025407a57b543a98e4246185bcee1d322e3e43bf674b294886ccc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MK2AVE9VHKMG.bat

Filesize
209B

MD5
0c34951595b73c57f964e822dabb02b6

SHA1
3f77a57a161f7f52cc2341ce9da202e595a2e713

SHA256
a5e1e71f4fc655b4480eec1d7b49e8d0952ccec98716bdbb77aa03be59c82d18

SHA512
21151f979269264e1e68000fe3a40ecc3c1b55bd6c9da21402e2e7b76fb189934401ce964a7d226af37e42006897baa9fbf15486e36db2d76c3ccb3c01d8ce4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ORBSIqwHfdJp.bat

Filesize
209B

MD5
15ca359fc0b53bafffb6efca0eac863b

SHA1
2906644007741f983408640411377e89f0c1cf18

SHA256
2472189cf350e42a5a99b0c81f47fb7fb09fe1eb604a617629038e766fc1d167

SHA512
dbfda6eb232cab8b7a4d483f190e79080407c04dbb756799efb18e108d8fd1e185ca4e53579e7eaccf3207a9236d693d2c8ace453ee2cd3f3f8193f9fe382b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKMpGujUR683.bat

Filesize
209B

MD5
79d43d8d6ee7301026261d9f0ec19327

SHA1
205641fa59245f33e1e80063c557dd68592eea29

SHA256
2ad019d581f295a9c9825c5a7da3d79784b035ef092ba333222c220330a65bc0

SHA512
74a27cdb3be69ed50138bb603c11c1ac63156849d0e4b5fe99dfd68a01aec9def4c1a73376a4108c23ba9d6765630f406a83e203a6c42a8d6b40cad8943d420d

Download Submit
C:\Users\Admin\AppData\Local\Temp\QM9EtjyS0MFg.bat

Filesize
209B

MD5
3af52d6b7e9a71788a9689de25c2663f

SHA1
87763e1769d9907c4ea7b2e7f52d0e70f06d0a68

SHA256
939cb303e259a0815d6a716d1fed45f7936839f1d56f7d762f3537051a4256b4

SHA512
28f22916f49bd3e14c523cd58202985dca0a679e0ed0cb82920d104d4aeb9ccad1439024f9143f2bd38511d03bef63d1050efd2f7d23d5a4afd7289156c3f1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\QmK6BgQyVqUG.bat

Filesize
209B

MD5
7fdee51683db4a4ad82f90f61e5c86e1

SHA1
37318fe1c91b9cf06e182925e855a94574c88e28

SHA256
a819d4acf44230380abe8a147a5e1b72708f75f08bb6ae22a4b17587800d1f08

SHA512
8fe2816bb496cc051f53060ee022ebd06316dea8e996ba575c01c66e63684b352596e6a4bade5205ebab20eb21c9c0a2f35e4e46e3a7f0afeee7ec00c4364b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RedBBgwy7auY.bat

Filesize
209B

MD5
de32d389b31b682ec4c292de830ed583

SHA1
af9d53a70a5a27f9907954e6c4bfaab2a216ca15

SHA256
65a159198d3f8ddc98d0fa3bb162f19c4cad349f30488b90466b0af71c43c2fa

SHA512
54a495e8fe654c7b72d702207791cdf3e10f850508d3ac3f9d898606a2bc6bab59a50c23dd331925803c564607008a40e4b8c9af15566a7a72a0fe7be60f95ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rexj9lZ6zF01.bat

Filesize
209B

MD5
032500da3b474eeb912504d1069b4d4b

SHA1
b59bccaef6cd09a2192673da35f08faf86b3d98b

SHA256
117a171530676cec2f1eceace84e7a220642d28f8f424ed98bc3879835965afc

SHA512
c203613b9fd655e291d181b7cf248d22c5f8f143a07b87a3f37c96d331c1c1cf48f97825e0a930fcaf6e3abdf36614a1a7c1c2c089eeeb0296c919ce69ad4f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\RoRoTAqoH6OG.bat

Filesize
209B

MD5
7112582f41ee9bd17b9425bf96764cb9

SHA1
b9292b8991ac621547bea35147f4aebe13e80218

SHA256
73a8ceba6e5f243da8c29591684cc1ed87b4681f9af563f8354a65549508d46f

SHA512
d5baf771a9639f3d80830590b8210d32d5537a07cba291e1f46431d65c020a47b70bfe959617780994a4b823dc0db7b55f464818b60e443421ef12d0d805bbd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\SnI369T4OAS6.bat

Filesize
209B

MD5
11b0ee7e63b5b957619e66886dce9be7

SHA1
0b01fbf4d3f5a5da4a2c6ec7bfeec5789443c5b9

SHA256
f0ab1f618691a3394cbffeac41a86369b24fc0700236395f4ba4d2dc97066d05

SHA512
a00c86d380285e7337f9760a04839d2b4290d6fcd06bc76ad249f0689a22015590dd892a189c7925ab5faac1f57a1de165f594d922c8d5d2bcb585e884697cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tnnsa6uKo3XS.bat

Filesize
209B

MD5
af940eb24297f8246e616770a30c8dec

SHA1
2236221c9d08b29aca83e4a567b1ec92875850af

SHA256
abac55a5b0c5f5cdb951767e3071168442d41ea4bf2aee0a72f4c83dec707e2f

SHA512
242b3dbe204820dccd4c8dca1cfff9a37834aa2018097ecf13080d26c48ef9d64bee450ca8962e7c2a2aa4d902bb1e530abaad5a47b3af0aa0fc39686cb02f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5dJTpZ5m1HB.bat

Filesize
213B

MD5
a9285296fb0c8a16c995a8e77645f6df

SHA1
47d04633a723566085ebde7b944d51a60058e48d

SHA256
38f124fe96061ffe95a28e7655572e9bd05ddd0ec4ceab0e2e49200a55e4d395

SHA512
3c40191990e69fd698d7d51b3b3cfd7dd2fe5796d00a690b80aee0d4c9f41791bce2cd1b5b757762b0accfb94422e38394857560c4d31b6e559b2ebb746e995e

Download Submit
C:\Users\Admin\AppData\Local\Temp\VkmxuKDPrcob.bat

Filesize
209B

MD5
34c9041d29dc1cbda1fe01c4ea172693

SHA1
a743d18d050df3126324d01f45d63ff5488c26ba

SHA256
56ac4c4ffacfb5e39bdf849473f411e3c259a586e1c0d81fb1c5504a7e32e547

SHA512
b1a8cf6c1921a0609845efd762c2b9b0de159def1c3e5a2351907c46424a37aa85a0920659a7859dc19eb17d42ab8f922dfa1b297e6923cca9e06fa7c852728f

Download Submit
C:\Users\Admin\AppData\Local\Temp\W1CVkhsfHM0R.bat

Filesize
209B

MD5
3025166565fc6e821ddab6671b51d7f2

SHA1
34647c84c66c38aa2bfbfd10e8436e8f651a80bf

SHA256
58850b993caf0620c882cc663f2638911a956059928b385702eeb0cae6f78800

SHA512
d786a8b552786d1464e65c31229a0dd81691a760365c0664c428ed524640a5ba18430eb8b333c1e536ea2cfacd1397c1d235646d6c8292ba9c8a6c2fb4ccb8a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZX2tcpuPuVNW.bat

Filesize
209B

MD5
b22fb75826c5c98af22c5d405cfa74cc

SHA1
37b293add10e4136fd3f23a8e77c54686a15e9d9

SHA256
9fe1c2b27e495402a9b9cef9dab875ee4f36239dc5d84d129e29931a6452ae84

SHA512
33fed33178eddc04bf7125f5ad1044683eb668795a960e36ad0a6fef488bc6a28a82376db209c4000c478c82d65eb8dcd36c78e314e8ceb4c234438562d42fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\anRdXWjCxZ6k.bat

Filesize
209B

MD5
3f233b5af632a388752f63ff81e00bf6

SHA1
6489fe80bef0146896f194d1bc366d91482f6db3

SHA256
f8ab02e79d12a35f325c22a768fe153bfbabdaf051bf05a59aa14cdd5ab8f568

SHA512
42819d469b00a1cc4f512c51f0fce9b3308e1d45ab7965f037c83b02d966e12ae3672be73134ce03b7846b92ff0d9e373341f3f7400fc7b6ea0ac778406a5494

Download Submit
C:\Users\Admin\AppData\Local\Temp\asIOWte6am6N.bat

Filesize
209B

MD5
e10bb22ab1e7d73df5b136768d752754

SHA1
0771bb2685315542627bb62ba5a5b340c009e92e

SHA256
f4a28b875c857d783668cc520f82a57fc05fd2d9f157b65256968be62d39a83c

SHA512
a4417c084f8a74d15cd12a651e4f3fa7ff18e5a05a323a714d3f6c27cd220abf675b66781616b6125825e40685401214466719cf9f2fb6f3ef79b0683815569f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cHZp7zVmJp2o.bat

Filesize
209B

MD5
049878a107c9ef347d89f7826645873c

SHA1
20d6e64c003e822dadea7c4dea07c562ab236099

SHA256
f42dac8df4a2117bc2e47340430598f1e216e84069f42a26ce9c856c4f8c9653

SHA512
4c5c1bf47ed1c01056c70b08c0c990c39b0a388f8f30afb863ef4976132a6888bc0d55befc9994b9d23db835d8421b4099ec20328636df8f27244fcb086554d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ePtWK1T1Au5N.bat

Filesize
209B

MD5
63567ff237ffb0d099691bfceab1dbf9

SHA1
85648c1226af6d3a44160594d3ee31beddce23cc

SHA256
8abb16ae1a6b9b0d5fcbf66595c0b29b878e774e7876dc9213fc642da0dcc8e2

SHA512
e6227eba59e27d5d290a6d32d3d864c1b0335c4cc3f5d36dc1288bc70e252db542442b141f9c96add7ccf5d2e381707323747e129c5578b1bbfa388f5529840b

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeTQRJjxFccb.bat

Filesize
209B

MD5
fed2f9e6558b7ba9e8bcabbe860e3828

SHA1
82ca1e2680bbaa310de8becadece27ae7daa4d55

SHA256
d2381d970a05c3cf1eead3b79b59fdd8e951185587ff2ef29fc6fbfee0b31203

SHA512
26f4a529c1ed0821c10626389f714f7504533fa20570cc35c45e4bbaff4fe304e7b4c89e42df0b356b7d6c6dd5f15ef5d99434a3458704d54e5175bf2900a6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\eojDj1pSesxw.bat

Filesize
209B

MD5
df338f3431c4ab6fe8646e8189beaf5d

SHA1
02b608675dc7804d7c0289ba756d1e08a96a5746

SHA256
6233ff3e94bef13546b49b86a9be1d5634a3215dfca85549c1b65f6c3754d9f6

SHA512
fe7169c3b5f5fc05a573b0322086e1843cf068e6eef9255a3f5b601ce5ef5cba60e874f0ff5ff7cdc30804c4f5a09c6287b72afc12bedc3a82feef5634de515b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4KBipi3H96.bat

Filesize
209B

MD5
ac5acf12d88ef9330939e3ad0d4452b4

SHA1
e1a3b164ccbbd45c49702d3fcb1762f8a12552ce

SHA256
4c3c8e591839328564649fea799fb6b8723b4d4ac64d72de58ef48c471ffb10d

SHA512
6c755b317801a222c1e240c4ced441666863f58db3320e1fed10536793c6c16d1970ce243a45f271e3e466154a0181b160131999f87e4d7c9febfb9e330145ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\i7HKkqBJo8Vw.bat

Filesize
209B

MD5
f1ea7781f8debe23315b75d319896532

SHA1
8c38d2fd6ec66125e4720d83916c1c4131ef8040

SHA256
2a12b660bfcb6f5904fdf0383ce2a0b3006b538859d0f14bf134df6654b30650

SHA512
407467461bda76baeb0e77d6adc58423eb59637635158be84aa944465fd1b1ae17855773f7364e8f85203853bca23f82c53eb09a6bade7abb1e63b52a50d1959

Download Submit
C:\Users\Admin\AppData\Local\Temp\ilaS5Ttm91Td.bat

Filesize
209B

MD5
47de1762ae26562b0bf8930bef52cd9e

SHA1
adf0f28c377e2cf97cda22dea7e8dc3c9b22defb

SHA256
eeb6431f2bf187a2873b31e7d6d5c6125c2f0c98dfe4765ea4484a276da959d1

SHA512
62f046b9d9e4a185f9142353e6566e3be09048511053de485542063b33c31d34f5cdffab2e8d23da0b24fbdf93816376281161d4b3c80db7451573828ac9bfa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixyWl3e3Khv9.bat

Filesize
209B

MD5
8e7b3579060230a2e7148fbd3d0a8bb0

SHA1
b084a831c2aed0483854cc1f3d66e4d744371f25

SHA256
b5e9bdf5ae69d2d1c86794e5e5c67164a364350f1462ef4959aa2e9c28d49b71

SHA512
200addd937e97884712c9242fa33ba35cf112d87c946436a05efa8b9e0c8f416bf20bee77d95c7429409a844073ba709ddc66dac339ffa9aeb2c7a0f56c20f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\kBMiA6qsUO3I.bat

Filesize
209B

MD5
15ea3fa40f7fc6ba4c874fb9dfcd4853

SHA1
fbc24e95a8a1df1a7eefa140e5bb829e935384cf

SHA256
698bba0787313b7fcac9afba37570b3ae51a7125c157ab4b2c15934b55c526ee

SHA512
89ba0c3ed74e221c29b007da6606ba90fc55d45696d1fa60b6c83a3d8ec2a8b815989fa8a253e5303b9dbce4465c25c717fb9d995efecc40c56e2a2f3eb6a755

Download Submit
C:\Users\Admin\AppData\Local\Temp\l1TqRd2V9zLF.bat

Filesize
209B

MD5
0e9e5fd462752e9e42f6adc2f051bff3

SHA1
85a3b65a2ad51ba9a017253e2ac2ec381574e971

SHA256
76f5f485b8dcf71e05444e78db9cf3d3d85e4b0cee22a76ee90380c2c9bcd35d

SHA512
1c971917508b616ca5ef283a9695dd1ea1dc9493f7559302410bbccccd27722a057233b7e5edebb43c70d3b4af4c6c00f1f2ea5415bb4b6ce0583e15187d4118

Download Submit
C:\Users\Admin\AppData\Local\Temp\rAiIPgehFV3l.bat

Filesize
209B

MD5
05c1c50b577db517f31f37729c16e723

SHA1
3bb37344da5268e3923aa33ee674ca60981cb4cf

SHA256
1085427507b5ebc00a3b02ef3a637f83db828d3bb0cdafcffd4971e2720cd5a0

SHA512
c60fe930d5389f681c5d9a5d8b70c58b3e41529c2c2bcdd9bb4bc0d2133d9d40be31254228620db3061ac7e47dc02fbd7768755e49be5eb2998a2520f24ea3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\rWj1mFqf0DCa.bat

Filesize
209B

MD5
a294f9007ce43b99c488858c009cf49f

SHA1
1a8d4eff274eaac2a10c5d16b19b013efd5d20b5

SHA256
ae8064bf8200639914ab09e4d02b37a106f6b80a0e5541d29f5853882ec7e92c

SHA512
bf73bacd721d8f122c404130b11a7c16a7109799facb283090a749b007dc58db48743a4d8af5b1e727891af4f4784f21696c95ac1c9b8700e8299bdd18a7f0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rx06UKRcIu3X.bat

Filesize
209B

MD5
3955b545a4d7e329b1d6b41e5179f8f5

SHA1
f20e17ba92189bd24bcba0ab9787d1a65cad2e5b

SHA256
f14daa535f26e39cca668881d6566c9d7017d03c258b7415cd928e2d98e4a082

SHA512
479b99d6bc899f32e1e5312222c09a748854078fca5a6e7fcdc73bfedf064011d577fd00f186397451a67802b220c8200158c46a7e4954f7db896e61ddd88f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\u8c6kN7ObX3n.bat

Filesize
209B

MD5
4b5a49f8f75dd72677f019f9f11ee1e4

SHA1
e6adf91bb9bcde012f9a0bcb7f495d765ba3448a

SHA256
4d20a73a05fc5b39fd16c0931ed17dc318dc35bb7b19e6168621abc473632ee1

SHA512
10b4ac5af7ef33244e38b825631aadab4b5ffb2cc2d7e5e9760fcb88dccc8f02db1dd485f54f64068234edf0a363ea2892cc1e177d4397508a74304de47bc93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vx8oYq8eLlS7.bat

Filesize
209B

MD5
28b9d8decd55e8f31011024986899435

SHA1
b99b4ea14bfd9fdf7591874f6f28b7be00d6acd2

SHA256
8d9e8d2c6206232b2aa62ce81ef2b19135e544c458050d216f972f332315223d

SHA512
cc3f570a13cacedfdfbbf6390ff66b331aa46cdccc413823d6bc75a3da68c6a8503f7626d44e6d87b3bfee3d27c04b21be9181202ca8e5b2e736e8391c6fa34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wKVA4DqfqPmY.bat

Filesize
209B

MD5
ec9372e75c1f8722d39f2155ced62d6f

SHA1
926086d2dabea202ac2ea212e207fc363d9a2a6b

SHA256
9771bde6e1167dec94c53341138e5b5a40b9d3e9cefdb2a2b74bc8a4a631adc9

SHA512
63af2154a7a116bb8a8ea22f655c57d03cccc88d57b3ecc3b7be7ba80998c7ba1b0208bc8015b20f152370521e4b9e7c2d4981c94dddd4f2a5a6e19240970446

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbsPHRKsvg9r.bat

Filesize
209B

MD5
d2595f707d751856fe721ce02df1f6c8

SHA1
8671a520eebb16e6e6edd618979ebbf22b7fd1ea

SHA256
d259f7d901ed661e50a34bd94d707419b9c69462406f9c7a2b28f2a40b1fcdfe

SHA512
37cdbffaccde69e26d02a90ccd3c42603b15fedee1179ac4c4e97fad3191533f76395548ddb8c7288abe826e72b7e305946ca7bf276966c8c2dd4cf0a2ce6a79

Download Submit
memory/700-17-0x00007FFA20B70000-0x00007FFA21631000-memory.dmp

Filesize
10.8MB

Download
memory/700-12-0x00007FFA20B70000-0x00007FFA21631000-memory.dmp

Filesize
10.8MB

Download
memory/700-13-0x00007FFA20B70000-0x00007FFA21631000-memory.dmp

Filesize
10.8MB

Download
memory/1768-3-0x00000000034E0000-0x0000000003530000-memory.dmp

Filesize
320KB

Download
memory/1768-1-0x0000000000F00000-0x0000000001224000-memory.dmp

Filesize
3.1MB

Download
memory/1768-2-0x00007FFA210C0000-0x00007FFA21B81000-memory.dmp

Filesize
10.8MB

Download
memory/1768-9-0x00007FFA210C0000-0x00007FFA21B81000-memory.dmp

Filesize
10.8MB

Download
memory/1768-0-0x00007FFA210C3000-0x00007FFA210C5000-memory.dmp

Filesize
8KB

Download
memory/1768-4-0x000000001C2E0000-0x000000001C392000-memory.dmp

Filesize
712KB

Download
memory/2060-219-0x0000000002E10000-0x0000000002E22000-memory.dmp

Filesize
72KB

Download
memory/2060-220-0x000000001B8D0000-0x000000001B90C000-memory.dmp

Filesize
240KB

Download