Overview

overview

10

Static

static

3

jaffacakes...zd.exe

windows10-2004-x64

10

jaffacakes...zd.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/10/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe
  • Size 2.1MB
  • Sample261016-e4ybeshs9k
  • SHA256 69956d237769fe359e2b3820abfb8ecc8dd047201a9fa7d074105c2f9557c8ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionquasarpersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.3.0.0

Botnet

  • BOTNET

C2

  • orden-tamplierov.ddns.net:1604

Mutex

  • QSR_MUTEX_aKbAK5f3mYUV6cdMca

Attributes
  • encryption_key

    SwuCDIynrbQUQArnczoL

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchoost

  • subdirectory

    SubDir

Signatures

  • Family: Quasar RAT 5 IoCs

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 64 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 26 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 52 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 24 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Identifies Wine through registry keys 2 TTPs 26 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 26 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 24 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 24 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 52 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 24 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe"
    1⤵
    • Family: Quasar RAT
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe" /rl HIGHEST /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4476
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HgxarJuULqZr.bat" "
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:508
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1888
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 localhost
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2500
        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4368
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dMNqLZQ6t8j7.bat" "
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1404
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              6⤵
                PID:1952
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 10 localhost
                6⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:872
              • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2624
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tzkxPEOmdcRz.bat" "
                  7⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4696
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4516
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 10 localhost
                    8⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4832
                  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                    8⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4236
                    • C:\Windows\SysWOW64\schtasks.exe
                      "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                      9⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:2160
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MFsHJe2Yoard.bat" "
                      9⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1980
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 65001
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:4264
                      • C:\Windows\SysWOW64\PING.EXE
                        ping -n 10 localhost
                        10⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:2756
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        10⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Reads the TCP/IP host and domain name from the registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3008
                        • C:\Windows\SysWOW64\schtasks.exe
                          "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                          11⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:4728
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eNOD9WbJF2SP.bat" "
                          11⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1984
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 65001
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:448
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 10 localhost
                            12⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:436
                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                            12⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Reads the TCP/IP host and domain name from the registry
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1256
                            • C:\Windows\SysWOW64\schtasks.exe
                              "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                              13⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:5080
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vzlKCBZ00VBG.bat" "
                              13⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3900
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 65001
                                14⤵
                                  PID:4264
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 10 localhost
                                  14⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:3932
                                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                  14⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Reads the TCP/IP host and domain name from the registry
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:648
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                    15⤵
                                    • System Location Discovery: System Language Discovery
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5020
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DeNqthvI20dd.bat" "
                                    15⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1196
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 65001
                                      16⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4344
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 10 localhost
                                      16⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:1952
                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                      16⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Reads the TCP/IP host and domain name from the registry
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3292
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                        17⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1316
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aPXcFAnf0CTS.bat" "
                                        17⤵
                                        • Executes a command shell one-liner
                                        • System Location Discovery: System Language Discovery
                                        PID:1492
                                        • C:\Windows\SysWOW64\chcp.com
                                          chcp 65001
                                          18⤵
                                            PID:1796
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping -n 10 localhost
                                            18⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:3540
                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                            18⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3080
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                              19⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2432
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OI6qVMGhkA01.bat" "
                                              19⤵
                                              • Executes a command shell one-liner
                                              PID:2596
                                              • C:\Windows\SysWOW64\chcp.com
                                                chcp 65001
                                                20⤵
                                                  PID:2136
                                                • C:\Windows\SysWOW64\PING.EXE
                                                  ping -n 10 localhost
                                                  20⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  • Runs ping.exe
                                                  PID:4480
                                                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                  20⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4636
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                    21⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4372
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KSwlplKvYezi.bat" "
                                                    21⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4384
                                                    • C:\Windows\SysWOW64\chcp.com
                                                      chcp 65001
                                                      22⤵
                                                        PID:3304
                                                      • C:\Windows\SysWOW64\PING.EXE
                                                        ping -n 10 localhost
                                                        22⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:2240
                                                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                        22⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Reads the TCP/IP host and domain name from the registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3108
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                          23⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3056
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WzldDTmXMQL6.bat" "
                                                          23⤵
                                                          • Executes a command shell one-liner
                                                          PID:3540
                                                          • C:\Windows\SysWOW64\chcp.com
                                                            chcp 65001
                                                            24⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3968
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping -n 10 localhost
                                                            24⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:1728
                                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                            24⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4264
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                              25⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1112
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JjQ9r9JkTOUv.bat" "
                                                              25⤵
                                                              • Executes a command shell one-liner
                                                              PID:3720
                                                              • C:\Windows\SysWOW64\chcp.com
                                                                chcp 65001
                                                                26⤵
                                                                  PID:3724
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping -n 10 localhost
                                                                  26⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:1008
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 2412
                                                                25⤵
                                                                • Program crash
                                                                PID:1584
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2412
                                                            23⤵
                                                            • Program crash
                                                            PID:4472
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 2428
                                                        21⤵
                                                        • Program crash
                                                        PID:1572
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 2404
                                                    19⤵
                                                    • Program crash
                                                    PID:448
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1884
                                                17⤵
                                                • Program crash
                                                PID:436
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 2428
                                            15⤵
                                            • Program crash
                                            PID:4828
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 2412
                                        13⤵
                                        • Program crash
                                        PID:3248
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2388
                                    11⤵
                                    • Program crash
                                    PID:1724
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 2156
                                9⤵
                                • Program crash
                                PID:1948
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2460
                            7⤵
                            • Program crash
                            PID:2004
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1916
                        5⤵
                        • Program crash
                        PID:548
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 2236
                    3⤵
                    • Program crash
                    PID:544
              • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe
                C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious behavior: EnumeratesProcesses
                PID:3020
              • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3924
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4172
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AkagKoIRpE5b.bat" "
                  2⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4192
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2072
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 10 localhost
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:2160
                  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:60
                    • C:\Windows\SysWOW64\schtasks.exe
                      "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                      4⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4988
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OV3kDF1cguUI.bat" "
                      4⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2448
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 65001
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:712
                      • C:\Windows\SysWOW64\PING.EXE
                        ping -n 10 localhost
                        5⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:4752
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        5⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1040
                        • C:\Windows\SysWOW64\schtasks.exe
                          "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                          6⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4256
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQQiGBeyvgil.bat" "
                          6⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1240
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 65001
                            7⤵
                              PID:4184
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 10 localhost
                              7⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:5100
                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                              7⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4064
                              • C:\Windows\SysWOW64\schtasks.exe
                                "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                8⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:832
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b6qyjSBZTys1.bat" "
                                8⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4812
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 65001
                                  9⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2852
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 10 localhost
                                  9⤵
                                  • System Location Discovery: System Language Discovery
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:748
                                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                  9⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:116
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                    10⤵
                                    • System Location Discovery: System Language Discovery
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4472
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uI7QRW66KJ9N.bat" "
                                    10⤵
                                    • Executes a command shell one-liner
                                    • Suspicious use of WriteProcessMemory
                                    PID:4548
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 65001
                                      11⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4056
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 10 localhost
                                      11⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4336
                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                      11⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:2072
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                        12⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2492
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IvbupKRGyWLy.bat" "
                                        12⤵
                                        • Executes a command shell one-liner
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2292
                                        • C:\Windows\SysWOW64\chcp.com
                                          chcp 65001
                                          13⤵
                                            PID:4888
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping -n 10 localhost
                                            13⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:2436
                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                            13⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Reads the TCP/IP host and domain name from the registry
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3136
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                              14⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2624
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VWAH5FEdDCMv.bat" "
                                              14⤵
                                              • Executes a command shell one-liner
                                              PID:2876
                                              • C:\Windows\SysWOW64\chcp.com
                                                chcp 65001
                                                15⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3940
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping -n 10 localhost
                                                15⤵
                                                • System Location Discovery: System Language Discovery
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:3220
                                              • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                15⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Reads the TCP/IP host and domain name from the registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1276
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                  16⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4852
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KUT1Ee3QM4Y4.bat" "
                                                  16⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3328
                                                  • C:\Windows\SysWOW64\chcp.com
                                                    chcp 65001
                                                    17⤵
                                                      PID:4088
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping -n 10 localhost
                                                      17⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:4284
                                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                      17⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Reads the TCP/IP host and domain name from the registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4176
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                        18⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:4504
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L5XyEnXIxPSz.bat" "
                                                        18⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2624
                                                        • C:\Windows\SysWOW64\chcp.com
                                                          chcp 65001
                                                          19⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4300
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping -n 10 localhost
                                                          19⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:4888
                                                        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                          19⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Reads the TCP/IP host and domain name from the registry
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:464
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                            20⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:4200
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Iac0isInqrwq.bat" "
                                                            20⤵
                                                            • Executes a command shell one-liner
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1120
                                                            • C:\Windows\SysWOW64\chcp.com
                                                              chcp 65001
                                                              21⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3220
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping -n 10 localhost
                                                              21⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:3800
                                                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                              21⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Reads the TCP/IP host and domain name from the registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1152
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                22⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2852
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUUO1aDejxIL.bat" "
                                                                22⤵
                                                                • Executes a command shell one-liner
                                                                PID:980
                                                                • C:\Windows\SysWOW64\chcp.com
                                                                  chcp 65001
                                                                  23⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1544
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping -n 10 localhost
                                                                  23⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:1312
                                                                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                  23⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4268
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    "schtasks" /create /tn "svchoost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                    24⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2944
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v4knnyWXabwP.bat" "
                                                                    24⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5060
                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                      chcp 65001
                                                                      25⤵
                                                                        PID:4992
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        ping -n 10 localhost
                                                                        25⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Runs ping.exe
                                                                        PID:1572
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 1860
                                                                      24⤵
                                                                      • Program crash
                                                                      PID:748
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 2412
                                                                  22⤵
                                                                  • Program crash
                                                                  PID:4352
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 1904
                                                              20⤵
                                                              • Program crash
                                                              PID:1464
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 2156
                                                          18⤵
                                                          • Program crash
                                                          PID:1120
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 2420
                                                      16⤵
                                                      • Program crash
                                                      PID:2736
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1892
                                                  14⤵
                                                  • Program crash
                                                  PID:2428
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 2408
                                              12⤵
                                              • Program crash
                                              PID:4932
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 2412
                                          10⤵
                                          • Program crash
                                          PID:4300
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 2404
                                      8⤵
                                      • Program crash
                                      PID:1384
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 2152
                                  6⤵
                                  • Program crash
                                  PID:852
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 2436
                              4⤵
                              • Program crash
                              PID:1288
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1832
                          2⤵
                          • Program crash
                          PID:4996
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 780 -ip 780
                        1⤵
                          PID:4516
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3924 -ip 3924
                          1⤵
                            PID:1196
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3388 -ip 3388
                            1⤵
                              PID:2104
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 60 -ip 60
                              1⤵
                                PID:4408
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4324 -ip 4324
                                1⤵
                                  PID:620
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1040 -ip 1040
                                  1⤵
                                    PID:4252
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4236 -ip 4236
                                    1⤵
                                      PID:2368
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4064 -ip 4064
                                      1⤵
                                        PID:4184
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3008 -ip 3008
                                        1⤵
                                          PID:3112
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 116 -ip 116
                                          1⤵
                                            PID:3056
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1256 -ip 1256
                                            1⤵
                                              PID:620
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2072 -ip 2072
                                              1⤵
                                                PID:4612
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 648 -ip 648
                                                1⤵
                                                  PID:5060
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3136 -ip 3136
                                                  1⤵
                                                    PID:4252
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3292 -ip 3292
                                                    1⤵
                                                      PID:4372
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1276 -ip 1276
                                                      1⤵
                                                        PID:4416
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3080 -ip 3080
                                                        1⤵
                                                          PID:1216
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4176 -ip 4176
                                                          1⤵
                                                            PID:2152
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4636 -ip 4636
                                                            1⤵
                                                              PID:5064
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 464 -ip 464
                                                              1⤵
                                                                PID:1188
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3108 -ip 3108
                                                                1⤵
                                                                  PID:5100
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1152 -ip 1152
                                                                  1⤵
                                                                    PID:3044
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4264 -ip 4264
                                                                    1⤵
                                                                      PID:3376
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4268 -ip 4268
                                                                      1⤵
                                                                        PID:1948

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Command and Scripting Interpreter

                                                                            1
                                                                            T1059

                                                                            Windows Command Shell

                                                                            1
                                                                            T1059.003

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Persistence

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Privilege Escalation

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Defense Evasion

                                                                            Debugger Evasion

                                                                            1
                                                                            T1622

                                                                            Virtualization/Sandbox Evasion

                                                                            2
                                                                            T1497

                                                                            Credential Access

                                                                            Discovery

                                                                            Debugger Evasion

                                                                            1
                                                                            T1622

                                                                            Query Registry

                                                                            4
                                                                            T1012

                                                                            Remote System Discovery

                                                                            1
                                                                            T1018

                                                                            System Information Discovery

                                                                            3
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            System Network Configuration Discovery

                                                                            3
                                                                            T1016

                                                                            Internet Connection Discovery

                                                                            2
                                                                            T1016.001

                                                                            Virtualization/Sandbox Evasion

                                                                            2
                                                                            T1497

                                                                            Lateral Movement

                                                                            Collection

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.exe.log
                                                                            • Size 1KB
                                                                            • SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            AkagKoIRpE5b.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AkagKoIRpE5b.bat
                                                                            • Size 207B
                                                                            • SHA256 427454fa2d3b2a1cdb627c5a35a7a87f3a3f8b0c336e304d3603a1959d5d319d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            DeNqthvI20dd.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\DeNqthvI20dd.bat
                                                                            • Size 207B
                                                                            • SHA256 06ee4c7f1bc5dc188a76fa649a17168c19702489d7f898f3baaaf7de0b193d7b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            FQQiGBeyvgil.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\FQQiGBeyvgil.bat
                                                                            • Size 207B
                                                                            • SHA256 a0074c2a32a74537cca9c92dbfdaa7691b74474e6bbc47ea0e5bca6701b522e4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            HgxarJuULqZr.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\HgxarJuULqZr.bat
                                                                            • Size 207B
                                                                            • SHA256 ca56c56b358022f193721628dc803e9e26e22e50de8c46d1fca04e1ce2269511
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Iac0isInqrwq.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Iac0isInqrwq.bat
                                                                            • Size 207B
                                                                            • SHA256 a0bbc91d0fae7283fc4f1088d4a75858a709129cb4c18a0aaeb40339ce04f0bb
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IvbupKRGyWLy.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IvbupKRGyWLy.bat
                                                                            • Size 207B
                                                                            • SHA256 cd3af75ede06597c4fc09a33ae269dccf506f4b43ab95306aa02c2dd6a0b586d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            KSwlplKvYezi.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\KSwlplKvYezi.bat
                                                                            • Size 207B
                                                                            • SHA256 1e6c982962c0e1ff2ad2b9dee90b08210c47189fcb94811f1a65d582be2ec360
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            KUT1Ee3QM4Y4.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\KUT1Ee3QM4Y4.bat
                                                                            • Size 207B
                                                                            • SHA256 4a10c35a59bf022f5fedcecb3a4f4272071e5ca789f380ade6449af52053db43
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            L5XyEnXIxPSz.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\L5XyEnXIxPSz.bat
                                                                            • Size 207B
                                                                            • SHA256 14b2374132e05f08b0a3ab2844f44e5840dffab648dcbbf1c66eb537844ccf7f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            MFsHJe2Yoard.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MFsHJe2Yoard.bat
                                                                            • Size 207B
                                                                            • SHA256 832fd11f2be8e907db55426d20c795b699fe04de14bac68d53f2e914e9e64e7f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            OI6qVMGhkA01.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OI6qVMGhkA01.bat
                                                                            • Size 207B
                                                                            • SHA256 c51e33d65b88e749a69a9d9135af8e582f58f9e88f28adbb6bd82f8259607964
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            OV3kDF1cguUI.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OV3kDF1cguUI.bat
                                                                            • Size 207B
                                                                            • SHA256 366607a768b574e40af1cd22da1c90531fbcb66f557dedcef132bbbd06102e40
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            VWAH5FEdDCMv.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\VWAH5FEdDCMv.bat
                                                                            • Size 207B
                                                                            • SHA256 df5dddf2cf2c5410cdb9c73e35309da2e92b0beb0deb56152f18f22e65a9b12d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            WzldDTmXMQL6.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\WzldDTmXMQL6.bat
                                                                            • Size 207B
                                                                            • SHA256 95b516a62f2593c10ff3161c32156ae2daa468ce00e7f7dc9a5dd37193b17920
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            aPXcFAnf0CTS.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aPXcFAnf0CTS.bat
                                                                            • Size 207B
                                                                            • SHA256 ff6142369c6dfd5b65d685d7db576668402dc72d36b7dd3e9868567b4ef52122
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            b6qyjSBZTys1.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\b6qyjSBZTys1.bat
                                                                            • Size 207B
                                                                            • SHA256 db508080ee6cfa4842009942959e734a4b96cad9e3b31c51d04f0cbbcee33e20
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            dMNqLZQ6t8j7.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\dMNqLZQ6t8j7.bat
                                                                            • Size 207B
                                                                            • SHA256 144aaa08222d07a4d9a540cf566e6d44d125450c63432a74b1912fa096102e73
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            eNOD9WbJF2SP.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\eNOD9WbJF2SP.bat
                                                                            • Size 207B
                                                                            • SHA256 f24566e423ee5e8ee2ede44178788f203c3494b7c658f85fdc796e1ff9bacb23
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            tzkxPEOmdcRz.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tzkxPEOmdcRz.bat
                                                                            • Size 207B
                                                                            • SHA256 b7db2e817b919dceaaf50ca9bdc826c46ae5dc6b5be7dada5528a10daefb82ce
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            uI7QRW66KJ9N.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uI7QRW66KJ9N.bat
                                                                            • Size 207B
                                                                            • SHA256 ac3b9b6e6505055979f8108f02899f44f8399b66af815cf66b9c51651958cf38
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            vzlKCBZ00VBG.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\vzlKCBZ00VBG.bat
                                                                            • Size 207B
                                                                            • SHA256 d2b5bb36569fdab9f9d1a0e18d0d3c5160e438d711abb274917e3eb4a4cb293b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 b2f661e655d20bc2972467daa20a2e05c23603ebf2e3b5011a13ec9cf68136fa
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 679ecf76ab295cea10dd8f60b3bf96ff029c6ea2f21eb7a0430c44d18c496a18
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 de9acd4cd18c3b9f26a85cc992d05d0351f9f8a385cc7fbe136890454eb8997e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 b074a5205ef1ebfa989374f1a61354c490075b1a41ef76acb19127d6e1d4cd41
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 8be90d65d3137864c408f71b6a3b2dde97b016374cf1f515fa1bbfee379e4184
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 daf2db683febaf772fb44c67bcac52ac7cbb54d4fcfcc4cb073905dcf9ce849c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 b45e0f819553b559f2b86c32756f33f1c81186aed81ebc9845478c5c1f70a03e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 909de126b2c260b350f201dce74dfc093c141d81c6f26d2f4f38660ec33d8faa
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 45c99331cfe296b35ba0b2bffce620f7287940123845edff904b76a1ec4abb58
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 68e291cd529252731b9c39ec81d7e116a7989d1fc36146f0a0b9d91186492a6b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 44fe59c67edbd1bcede69af5c4ee47b93af1da2ee4f1ff16f7c2adb21210583c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 7981f36ef332cad2240099b91247b88f737736c2adefb468c53c465d344bc2a1
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 5a9c0698ba31aee45206224371dfc901170ff6ac718b24b858d58dfd8f33b6f9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 ed8084d010b39982f69e67516c94f6dc095b294ac5476d2779dd276e8ad7b3bb
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 3edf13e7ea0de93f0bf3339c88a04f17aff0223b6eb9e810a00c22aa28019307
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 6abeb49d996de8fd7bdc12ab545aed088fd36747ac620f1e37f78bbbecb2ef33
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            10-16-2026
                                                                            • Path C:\Users\Admin\AppData\Roaming\Logs\10-16-2026
                                                                            • Size 224B
                                                                            • SHA256 7500c7895368cb09e62f8c1b2c266ffa79fb9aa88fd46974452fe88b8534db55
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Client.exe
                                                                            • Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                            • Size 2.1MB
                                                                            • SHA256 69956d237769fe359e2b3820abfb8ecc8dd047201a9fa7d074105c2f9557c8ab
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            memory/60-68-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/60-60-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/60-59-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/60-58-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/116-130-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/116-131-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/116-140-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/116-132-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/464-252-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/464-260-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/464-251-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/464-248-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/648-178-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/648-168-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/648-167-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/648-166-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/780-17-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/780-36-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/780-13-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/780-24-0x0000000008DB0000-0x0000000008DBA000-memory.dmp
                                                                            Download

                                                                            memory/780-18-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1040-82-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1040-83-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1040-84-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1040-92-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1256-152-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1256-144-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1256-143-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1256-142-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1276-204-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1276-203-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1276-212-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/1276-202-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/2072-155-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/2072-156-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/2072-154-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/2072-164-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3008-128-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3008-118-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3008-119-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3008-120-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3020-19-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3020-21-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3020-22-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3020-26-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3080-214-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3080-215-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3080-216-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3080-224-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3108-262-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3108-263-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3136-176-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3136-179-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3136-180-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3136-188-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3292-190-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3292-191-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3292-192-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3292-200-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3388-46-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3388-56-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3388-48-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3388-47-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3608-4-0x00000000073F0000-0x0000000007482000-memory.dmp
                                                                            Download

                                                                            memory/3608-0-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3608-16-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3608-7-0x0000000008740000-0x000000000877C000-memory.dmp
                                                                            Download

                                                                            memory/3608-3-0x0000000007A50000-0x0000000007FF4000-memory.dmp
                                                                            Download

                                                                            memory/3608-6-0x0000000007A00000-0x0000000007A12000-memory.dmp
                                                                            Download

                                                                            memory/3608-1-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3608-2-0x00000000007D0000-0x0000000000BE2000-memory.dmp
                                                                            Download

                                                                            memory/3608-5-0x00000000074A0000-0x0000000007506000-memory.dmp
                                                                            Download

                                                                            memory/3924-33-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3924-44-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3924-34-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/3924-30-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4064-106-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4064-107-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4064-108-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4064-116-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4176-226-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4176-228-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4176-227-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4176-236-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4236-96-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4236-104-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4236-95-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4236-94-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4324-71-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4324-72-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4324-80-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4324-70-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4636-238-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4636-250-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4636-239-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download

                                                                            memory/4636-240-0x0000000000290000-0x00000000006A2000-memory.dmp
                                                                            Download