quasar | 1dbd721913fb0aee8bda01304351c24f842d2e63e6bbedfc1faccfe889006cc1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/04/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260402-crd1xaet2z
SHA256 1dbd721913fb0aee8bda01304351c24f842d2e63e6bbedfc1faccfe889006cc1
MD5 ff4e51407d4f05f88fcfe977281441f9
SHA1 896ed3162471debe2ac3820c9226f14adbf95c1e
SHA512 098b01b8bd0a705a270014284ef800a59919c8253979048d2f6fc87c3b2a382cf1822f819315f8888de6e39e231e67ab839af41ea85e82e0186862aa9fb90ea2
SSDEEP 49152:6yhJJHPNCC7J98vBgJh99oG4znXisxUuxGiTHHB72eh2NT:6yhrHPh7J98vGJh99tYx
TLSH
T1DDE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilac365xb.tv
malware.xoilac365xb.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4944-0-0x0000000000C30000-0x0000000000F5C000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	messenger_update.exe
Token: SeDebugPrivilege	5048	messenger_update.exe
Token: SeDebugPrivilege	2272	messenger_update.exe
Token: SeDebugPrivilege	2076	messenger_update.exe
Token: SeDebugPrivilege	2648	messenger_update.exe
Token: SeDebugPrivilege	960	messenger_update.exe
Token: SeDebugPrivilege	3516	messenger_update.exe
Token: SeDebugPrivilege	4956	messenger_update.exe
Token: SeDebugPrivilege	5340	messenger_update.exe
Token: SeDebugPrivilege	2456	messenger_update.exe
Token: SeDebugPrivilege	5808	messenger_update.exe
Token: SeDebugPrivilege	3952	messenger_update.exe
Token: SeDebugPrivilege	224	messenger_update.exe
Token: SeDebugPrivilege	2260	messenger_update.exe
Token: SeDebugPrivilege	4744	messenger_update.exe
Token: SeDebugPrivilege	2024	messenger_update.exe
Token: SeDebugPrivilege	5988	messenger_update.exe
Token: SeDebugPrivilege	1588	messenger_update.exe
Token: SeDebugPrivilege	2360	messenger_update.exe
Token: SeDebugPrivilege	4724	messenger_update.exe
Token: SeDebugPrivilege	5040	messenger_update.exe
Token: SeDebugPrivilege	1216	messenger_update.exe
Token: SeDebugPrivilege	3412	messenger_update.exe
Token: SeDebugPrivilege	992	messenger_update.exe
Token: SeDebugPrivilege	1820	messenger_update.exe
Token: SeDebugPrivilege	2452	messenger_update.exe
Token: SeDebugPrivilege	5344	messenger_update.exe
Token: SeDebugPrivilege	2432	messenger_update.exe
Token: SeDebugPrivilege	5544	messenger_update.exe
Token: SeDebugPrivilege	3208	messenger_update.exe
Token: SeDebugPrivilege	2384	messenger_update.exe
Token: SeDebugPrivilege	2796	messenger_update.exe
Token: SeDebugPrivilege	1800	messenger_update.exe
Token: SeDebugPrivilege	5628	messenger_update.exe
Token: SeDebugPrivilege	2448	messenger_update.exe
Token: SeDebugPrivilege	5056	messenger_update.exe
Token: SeDebugPrivilege	3104	messenger_update.exe
Token: SeDebugPrivilege	2512	messenger_update.exe
Token: SeDebugPrivilege	3292	messenger_update.exe
Token: SeDebugPrivilege	572	messenger_update.exe
Token: SeDebugPrivilege	2932	messenger_update.exe
Token: SeDebugPrivilege	1268	messenger_update.exe
Token: SeDebugPrivilege	3900	messenger_update.exe
Token: SeDebugPrivilege	5688	messenger_update.exe
Token: SeDebugPrivilege	5304	messenger_update.exe
Token: SeDebugPrivilege	5464	messenger_update.exe
Token: SeDebugPrivilege	4340	messenger_update.exe
Token: SeDebugPrivilege	4168	messenger_update.exe
Token: SeDebugPrivilege	4148	messenger_update.exe
Token: SeDebugPrivilege	3968	messenger_update.exe
Token: SeDebugPrivilege	1148	messenger_update.exe
Token: SeDebugPrivilege	2884	messenger_update.exe
Token: SeDebugPrivilege	2504	messenger_update.exe
Token: SeDebugPrivilege	3484	messenger_update.exe
Token: SeDebugPrivilege	4240	messenger_update.exe
Token: SeDebugPrivilege	1256	messenger_update.exe
Token: SeDebugPrivilege	2908	messenger_update.exe
Token: SeDebugPrivilege	564	messenger_update.exe
Token: SeDebugPrivilege	3792	messenger_update.exe
Token: SeDebugPrivilege	904	messenger_update.exe
Token: SeDebugPrivilege	5260	messenger_update.exe
Token: SeDebugPrivilege	5572	messenger_update.exe
Token: SeDebugPrivilege	1260	messenger_update.exe
Token: SeDebugPrivilege	2120	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 5024	4944	messenger_update.exe	80
PID 5024 wrote to memory of 760	5024	cmd.exe	82
PID 5024 wrote to memory of 5048	5024	cmd.exe	83
PID 5048 wrote to memory of 3300	5048	messenger_update.exe	84
PID 3300 wrote to memory of 396	3300	cmd.exe	86
PID 3300 wrote to memory of 2272	3300	cmd.exe	87
PID 2272 wrote to memory of 5180	2272	messenger_update.exe	88
PID 5180 wrote to memory of 3292	5180	cmd.exe	90
PID 5180 wrote to memory of 2076	5180	cmd.exe	91
PID 2076 wrote to memory of 588	2076	messenger_update.exe	92
PID 588 wrote to memory of 4676	588	cmd.exe	94
PID 588 wrote to memory of 2648	588	cmd.exe	95
PID 2648 wrote to memory of 916	2648	messenger_update.exe	96
PID 916 wrote to memory of 1664	916	cmd.exe	98
PID 916 wrote to memory of 960	916	cmd.exe	99
PID 960 wrote to memory of 2936	960	messenger_update.exe	100
PID 2936 wrote to memory of 1688	2936	cmd.exe	102
PID 2936 wrote to memory of 3516	2936	cmd.exe	103
PID 3516 wrote to memory of 4868	3516	messenger_update.exe	104
PID 4868 wrote to memory of 2072	4868	cmd.exe	106
PID 4868 wrote to memory of 4956	4868	cmd.exe	107
PID 4956 wrote to memory of 3704	4956	messenger_update.exe	108
PID 3704 wrote to memory of 5348	3704	cmd.exe	110
PID 3704 wrote to memory of 5340	3704	cmd.exe	111
PID 5340 wrote to memory of 5252	5340	messenger_update.exe	112
PID 5252 wrote to memory of 5216	5252	cmd.exe	114
PID 5252 wrote to memory of 2456	5252	cmd.exe	115
PID 2456 wrote to memory of 5392	2456	messenger_update.exe	116
PID 5392 wrote to memory of 3832	5392	cmd.exe	118
PID 5392 wrote to memory of 5808	5392	cmd.exe	119
PID 5808 wrote to memory of 4548	5808	messenger_update.exe	120
PID 4548 wrote to memory of 3208	4548	cmd.exe	122
PID 4548 wrote to memory of 3952	4548	cmd.exe	123
PID 3952 wrote to memory of 1496	3952	messenger_update.exe	124
PID 1496 wrote to memory of 5920	1496	cmd.exe	126
PID 1496 wrote to memory of 224	1496	cmd.exe	127
PID 224 wrote to memory of 2020	224	messenger_update.exe	128
PID 2020 wrote to memory of 432	2020	cmd.exe	130
PID 2020 wrote to memory of 2260	2020	cmd.exe	131
PID 2260 wrote to memory of 5844	2260	messenger_update.exe	132
PID 5844 wrote to memory of 900	5844	cmd.exe	134
PID 5844 wrote to memory of 4744	5844	cmd.exe	135
PID 4744 wrote to memory of 2060	4744	messenger_update.exe	136
PID 2060 wrote to memory of 936	2060	cmd.exe	138
PID 2060 wrote to memory of 2024	2060	cmd.exe	139
PID 2024 wrote to memory of 6008	2024	messenger_update.exe	140
PID 6008 wrote to memory of 1848	6008	cmd.exe	142
PID 6008 wrote to memory of 5988	6008	cmd.exe	143
PID 5988 wrote to memory of 6096	5988	messenger_update.exe	144
PID 6096 wrote to memory of 6044	6096	cmd.exe	146
PID 6096 wrote to memory of 1588	6096	cmd.exe	147
PID 1588 wrote to memory of 1508	1588	messenger_update.exe	148
PID 1508 wrote to memory of 1892	1508	cmd.exe	150
PID 1508 wrote to memory of 2360	1508	cmd.exe	151
PID 2360 wrote to memory of 5096	2360	messenger_update.exe	152
PID 5096 wrote to memory of 5080	5096	cmd.exe	154
PID 5096 wrote to memory of 4724	5096	cmd.exe	155
PID 4724 wrote to memory of 1860	4724	messenger_update.exe	156
PID 1860 wrote to memory of 3264	1860	cmd.exe	158
PID 1860 wrote to memory of 5040	1860	cmd.exe	159
PID 5040 wrote to memory of 4084	5040	messenger_update.exe	160
PID 4084 wrote to memory of 3884	4084	cmd.exe	162
PID 4084 wrote to memory of 1216	4084	cmd.exe	163
PID 1216 wrote to memory of 3588	1216	messenger_update.exe	164

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XcCxelKsvF3m.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RkjE8X34dJRf.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BqbYSgasagX8.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nliLVdsMMCjK.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s4WsB7P29pO2.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p6uU879agVh2.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYkJXwBTCG14.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Vn89sL7AJaei.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9v7MqyJcqbhc.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oPGYUHvYS7nZ.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZgzrDfbKi3VQ.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4Lw6F5W0deA7.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2hV2bvXfL0Ab.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKHjzGBS2JYx.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:5844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mZbUCuJWSsED.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SslvMaY2LXtg.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nDABnJvs4bmL.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:6096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UaNRcEiRWWu4.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CClZzmnF8zP6.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oJf0ZQLFk0k7.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bP1AdWIHPNmn.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QTNIDiz7g8kP.bat" "
        44⤵
        
        PID:3588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LAQw7UURvQDy.bat" "
        46⤵
        
        PID:3112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mZGZiIlkhZCT.bat" "
        48⤵
        
        PID:5156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EuqsA1lp9bP7.bat" "
        50⤵
        
        PID:4120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\39TSJbripVax.bat" "
        52⤵
        
        PID:5848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6iN5a9E6iHN6.bat" "
        54⤵
        
        PID:5216
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IbknriugfYeC.bat" "
        56⤵
        
        PID:5440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\95xP3eDhcOdQ.bat" "
        58⤵
        
        PID:5812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mhsMc4N1qXyc.bat" "
        60⤵
        
        PID:3240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5LcE36i6YO3F.bat" "
        62⤵
        
        PID:3864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p28uIbbowD1B.bat" "
        64⤵
        
        PID:5656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96C1hAGM5Bwy.bat" "
        66⤵
        
        PID:4520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dewRDx4RADY7.bat" "
        68⤵
        
        PID:5664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Aojr6tFjKCge.bat" "
        70⤵
        
        PID:5884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s36GBIKDgbCb.bat" "
        72⤵
        
        PID:3856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\blUrbf3XSjj1.bat" "
        74⤵
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TyusAmvOnCdb.bat" "
        76⤵
        
        PID:4224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1qrv3iRSixfF.bat" "
        78⤵
        
        PID:3420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Aoc7fGfmjgbO.bat" "
        80⤵
        
        PID:4528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cZr9tTSXjXoi.bat" "
        82⤵
        
        PID:4544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rcv3oz3Im1hE.bat" "
        84⤵
        
        PID:4904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f8zQlY3r6kCo.bat" "
        86⤵
        
        PID:4012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jR6kIequiLjc.bat" "
        88⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nb09mFHJYAiO.bat" "
        90⤵
        
        PID:5284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUVUz2rf9Sfk.bat" "
        92⤵
        
        PID:3776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GhEJkxYpxzap.bat" "
        94⤵
        
        PID:4820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Id4l77NBpjBf.bat" "
        96⤵
        
        PID:2760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Yl1piYBWO5UT.bat" "
        98⤵
        
        PID:3160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QNQMZrAcxsCk.bat" "
        100⤵
        
        PID:3012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OjH3w1da4Lri.bat" "
        102⤵
        
        PID:2472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YlgJlcu54YwM.bat" "
        104⤵
        
        PID:5636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fm7xazVk4ZTQ.bat" "
        106⤵
        
        PID:4464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BhH9dZGpvwH.bat" "
        108⤵
        
        PID:4972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        109⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwxJeh9jTz2E.bat" "
        110⤵
        
        PID:4896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        111⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tTqpRluxUPtX.bat" "
        112⤵
        
        PID:1348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        113⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LC6TCxgQdarS.bat" "
        114⤵
        
        PID:5092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        115⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fR14cFM4PdQd.bat" "
        116⤵
        
        PID:1896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        117⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E4ajfIMka7C9.bat" "
        118⤵
        
        PID:4412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        119⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Bb3L49YMqzuo.bat" "
        120⤵
        
        PID:5660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        121⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rz7nIZCMJmJ2.bat" "
        122⤵
        
        PID:5448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        123⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZysRvibT941f.bat" "
        124⤵
        
        PID:5528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        125⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uVkvwVyMhStf.bat" "
        126⤵
        
        PID:240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        127⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcI9A9XYn9b8.bat" "
        128⤵
        
        PID:128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        129⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        129⤵
        
        PID:4804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkffUTmJhzKq.bat" "
        130⤵
        
        PID:1556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        131⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        131⤵
        
        PID:3212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\spULMb6ZgU6s.bat" "
        132⤵
        
        PID:356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        133⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        133⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S7lZs174egJ9.bat" "
        134⤵
        
        PID:5588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        135⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        135⤵
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oXUFbfTShI2T.bat" "
        136⤵
        
        PID:3912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        137⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        137⤵
        
        PID:4284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KC3wEe0LHsIM.bat" "
        138⤵
        
        PID:4144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        139⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        139⤵
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CZ6zeQIYatKR.bat" "
        140⤵
        
        PID:5168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        141⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        141⤵
        
        PID:788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aYeIuhCnghWA.bat" "
        142⤵
        
        PID:500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        143⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        143⤵
        
        PID:4000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PJOZujwmZmwc.bat" "
        144⤵
        
        PID:1308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        145⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        145⤵
        
        PID:3784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIHzVna8BvZh.bat" "
        146⤵
        
        PID:4020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        147⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        147⤵
        
        PID:2660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIUtvJFdT69F.bat" "
        148⤵
        
        PID:2072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        149⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        149⤵
        
        PID:1036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QdYYkUutBRBp.bat" "
        150⤵
        
        PID:5744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        151⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        151⤵
        
        PID:5268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ayQaot0xuoHA.bat" "
        152⤵
        
        PID:3992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        153⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        153⤵
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8q3imRL6cA74.bat" "
        154⤵
        
        PID:5452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        155⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        155⤵
        
        PID:3880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3lO5bqnvn0tR.bat" "
        156⤵
        
        PID:720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        157⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        157⤵
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z227ehbKCAdE.bat" "
        158⤵
        
        PID:5700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        159⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        159⤵
        
        PID:5964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CtcqxvUDlHbK.bat" "
        160⤵
        
        PID:4856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        161⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        161⤵
        
        PID:432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wHGzCKaQP24X.bat" "
        162⤵
        
        PID:2116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        163⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        163⤵
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yLpzBQY77sUh.bat" "
        164⤵
        
        PID:5900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        165⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        165⤵
        
        PID:5764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qLPpBfDR6vr0.bat" "
        166⤵
        
        PID:3344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        167⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        167⤵
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EbVKaD3VAJem.bat" "
        168⤵
        
        PID:3436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        169⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        169⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Td3YkKrOXTsO.bat" "
        170⤵
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        171⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        171⤵
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AdylVjsNklrI.bat" "
        172⤵
        
        PID:1088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        173⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        173⤵
        
        PID:3548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IF63Kn8v6X5o.bat" "
        174⤵
        
        PID:2220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        175⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        175⤵
        
        PID:668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xDJx7JOBLAq6.bat" "
        176⤵
        
        PID:4040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        177⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        177⤵
        
        PID:2620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d2PYCTowhIyp.bat" "
        178⤵
        
        PID:5352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        179⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        179⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QBhXxaRPrNFH.bat" "
        180⤵
        
        PID:1356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        181⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        181⤵
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYaFY5DgzWCZ.bat" "
        182⤵
        
        PID:5820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        183⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        183⤵
        
        PID:3400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BtXMyXZTp60F.bat" "
        184⤵
        
        PID:5516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        185⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        185⤵
        
        PID:4160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hu18k0VXOgV7.bat" "
        186⤵
        
        PID:2904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        187⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        187⤵
        
        PID:1420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgrKAana5JaN.bat" "
        188⤵
        
        PID:5016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        189⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        189⤵
        
        PID:2224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWp3k82w050v.bat" "
        190⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        191⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        191⤵
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wq2pMqUrIPdx.bat" "
        192⤵
        
        PID:5596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        193⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        193⤵
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O9b5flBDRsCv.bat" "
        194⤵
        
        PID:6092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        195⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        195⤵
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uViP6uDBKWUC.bat" "
        196⤵
        
        PID:4592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        197⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        197⤵
        
        PID:4220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b8iuEhHl5WJJ.bat" "
        198⤵
        
        PID:2172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        199⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        199⤵
        
        PID:888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mT6lu6owD5PR.bat" "
        200⤵
        
        PID:2364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        201⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        201⤵
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Ix2uWU62OjZ.bat" "
        202⤵
        
        PID:4864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        203⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        203⤵
        
        PID:4588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2fnO55HYGQeh.bat" "
        204⤵
        
        PID:5932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        205⤵
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        205⤵
        
        PID:2824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sYNrq72T6ERB.bat" "
        206⤵
        
        PID:3272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        207⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        207⤵
        
        PID:5368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DMvdAkjyJOUe.bat" "
        208⤵
        
        PID:1032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        209⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        209⤵
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IAHy4y185sbv.bat" "
        210⤵
        
        PID:5072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        211⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        211⤵
        
        PID:5624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CirANqMHgAtU.bat" "
        212⤵
        
        PID:5036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        213⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        213⤵
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QYimmXlcp3br.bat" "
        214⤵
        
        PID:5944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        215⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        215⤵
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G1hzzlzCj2pm.bat" "
        216⤵
        
        PID:3416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        217⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        217⤵
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\llWtSbjTrLac.bat" "
        218⤵
        
        PID:5076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        219⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        219⤵
        
        PID:3028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fONzxBfoHbLu.bat" "
        220⤵
        
        PID:5880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        221⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        221⤵
        
        PID:5684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lH7Zvyt3Rhxh.bat" "
        222⤵
        
        PID:5524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        223⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        223⤵
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PXboi5y3xCit.bat" "
        224⤵
        
        PID:5264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        225⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        225⤵
        
        PID:6128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R2IUaVsFflsK.bat" "
        226⤵
        
        PID:4448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        227⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        227⤵
        
        PID:2344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ds875Ke1H5rz.bat" "
        228⤵
        
        PID:3000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        229⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        229⤵
        
        PID:1380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\T7rOk0ITZ3Zl.bat" "
        230⤵
        
        PID:4936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        231⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        231⤵
        
        PID:3200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E1xystpZlhDC.bat" "
        232⤵
        
        PID:3700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        233⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        233⤵
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AIdLhXRUycAv.bat" "
        234⤵
        
        PID:4576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        235⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        235⤵
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0EMLtC4e9PWu.bat" "
        236⤵
        
        PID:5372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        237⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        237⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xb6F7HIc8I3N.bat" "
        238⤵
        
        PID:1668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        239⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        239⤵
        
        PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

1qrv3iRSixfF.bat

Path C:\Users\Admin\AppData\Local\Temp\1qrv3iRSixfF.bat
Size 185B
SHA256 70e34335fdcafa495b0174f67176adc1174d3cd86cca4b14f8af4a8c6a2d11a4
MD5 6627243716a4c5e88f813f026c6d5e17
SHA1 6499a048a427230fd796eb0a7a692a3c699ee4bd
SHA512 742cc39ab37106efcc5738d732a7ed2927a7b80e8ba6d2a109947640d1ca6a0282af15b359eed38f0905b10306d65fe71794fa0ba04f614b230a6d8e29fb640f
TLSH
T1AAC0120159818A5E45045C0A1DAA768CF096089E294A7FA04A51889E23D6C58B5DF7C6
MD5 SHA1 SHA512 TLSH

Submit Download

2hV2bvXfL0Ab.bat

Path C:\Users\Admin\AppData\Local\Temp\2hV2bvXfL0Ab.bat
Size 185B
SHA256 b9c4351f80990afdc794e752c52dd0f08e729b619ed70ba5c760f90e832aed1f
MD5 d65a50f1bf352154d596821a94bf795d
SHA1 ee3a0d1a65958c89e34ed21937512a50dcffd361
SHA512 7faf37c4e35375ab5b32a7c1b409e69b391db97aabe4fe257935a2490102bacf6f8fb9986bab8d2672bcf5a0214da210e11d46d9d4de717635e0524f3ba80b31
TLSH
T151C0120241868A5E45055C1A19E966CCF09A08A929497FA44641C85C23D2C5DB9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

39TSJbripVax.bat

Path C:\Users\Admin\AppData\Local\Temp\39TSJbripVax.bat
Size 185B
SHA256 ea33c749a146b58cb3e1b60aa517307d5da893ca2ed86325dcae8a266af57935
MD5 fd44f7fd732324b97ec3bdf80233feff
SHA1 4e1eff30bd7ce80caaf20e69df601ead4d38413a
SHA512 90ce7adcb1a8346d7c3c5aa30920bbf1774f66324062bcfa3127934eb73839cf5edef2f86d45955c392c52328c7261b517068afbdd59589d63b691cef7455101
TLSH
T1D5C0120191828A6E46545C0A19A9778CF1D5089D6A497FA14545C85C17D3C5CB5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

4Lw6F5W0deA7.bat

Path C:\Users\Admin\AppData\Local\Temp\4Lw6F5W0deA7.bat
Size 185B
SHA256 22a8f6819277c04feb7e80cad8ce32c5bc981ddd1523d573a6000aaaef1d7e88
MD5 7bfeea09076b2e11ae1a52017ece2e63
SHA1 0a24acecdd3615c6b69666095ddf3bc9d7cb4691
SHA512 dd9166b0be1fe880a646c572368802c2682e51a667b10e5e239a154b2c4646e1e05574ff5ddf1737df3ade6e35797f0f3d018a0672de8a45b49eaaf9e7353ad8
TLSH
T12DC022014181CA1E09000C0A18B963CCF09508992948BFA00640C84C23D2C99B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

5LcE36i6YO3F.bat

Path C:\Users\Admin\AppData\Local\Temp\5LcE36i6YO3F.bat
Size 185B
SHA256 1869bb9f5f1e8d360f4a26739f8c138c825bcec5a27b9cc914670d760c1a3953
MD5 f97eab1ae0f71cef785c551eb368a07c
SHA1 18249a0a619615a2074bfa3ecd011bb2df0f40cb
SHA512 ae9a410ccedb4e559f92a561db17367912d59b1a63f3a00c61b022e2e340798799377ef6209fed7381baddfe15864fdc44a2175cad82e854822bf686c755f528
TLSH
T116C0120142828A5E49045C1B59B9A68CF095089969497FA04501CC5C57D7C59B9DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

6iN5a9E6iHN6.bat

Path C:\Users\Admin\AppData\Local\Temp\6iN5a9E6iHN6.bat
Size 185B
SHA256 a97dcdb45d16580df3f0688e339bfac9c2dc786ecbb38cd24482ae34634b1283
MD5 f16bba741977a84af592b65101724af7
SHA1 f085f0f333c98c77233cab8b1f229a7f1492794d
SHA512 ed86bcdec9f2f274a7dfff6735d3f9daa63de719ea71a7aa04b0dfab03e9e95fc8e63c90426863200b5690fbcb3a444371fb3b34e2d6e91e212a518a0de12400
TLSH
T1B2C01201A181CA6E45045C0A19A967CCF0D5099929497FA04A01C85D13D3C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

95xP3eDhcOdQ.bat

Path C:\Users\Admin\AppData\Local\Temp\95xP3eDhcOdQ.bat
Size 185B
SHA256 61761e348344d11b836fa4b28872e08960428803fabbc0e9cef8e42ac317928e
MD5 c7192a9c6e63682510e42c5e7fd960d3
SHA1 ca7f835c0e52be052a0a2010fcd757fc866d36a8
SHA512 199b41845d27007b64ac9e5070a41f544d29aa8e75c9fde4f30e1c747e619043e642ca200d04bb1e55794910bc24de945e044882da0ecdfd01472ab2e624cf6f
TLSH
T1F4C0120142968A6E4A045C1A19A9B68CF0D6099D2E49BFA04911C89D67D3C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

96C1hAGM5Bwy.bat

Path C:\Users\Admin\AppData\Local\Temp\96C1hAGM5Bwy.bat
Size 185B
SHA256 8c4bae4c0a7ee55a3690f16ab777ba83c21ca729e11309119c3094fc41ff8e7a
MD5 adaa9c016a326484726696be5cce4b75
SHA1 64b1b8053755f31e1b1c52548914e6f528376336
SHA512 0b77892b44c199cfb1621d7dbd5bccc8c582faf874108df8e64cb66075fd7d46d1b22f484bdaa1eb199d5ca067c39df56cbcd14e6bfce603cf06bbf71f376665
TLSH
T1C8C0120142818A5E56045C0A59A96ACCF199089E2A497FA44A01885D27D6C59B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

9BhH9dZGpvwH.bat

Path C:\Users\Admin\AppData\Local\Temp\9BhH9dZGpvwH.bat
Size 185B
SHA256 d6fc38c045cfce03bc8fe0d178891e743ae66225205dd326aabbca337dad0826
MD5 1578a3b7f7762461f033365250b4d5f6
SHA1 7c4d9b9ac670369d66370800df98c59612e4515d
SHA512 5c961db9fd5bad93bb45eaf30884470d930b5b2586000d86c0acccd5f81a3f38bb43ee1b90c2f2e1f1d306b79c930226e877960855df7c70e65cb0566ac68e41
TLSH
T10AC0120182928B5E56045C1A19AA66CCF095099D29497FA48601C85C67D2C58B9DB7A2
MD5 SHA1 SHA512 TLSH

Submit Download

9v7MqyJcqbhc.bat

Path C:\Users\Admin\AppData\Local\Temp\9v7MqyJcqbhc.bat
Size 185B
SHA256 a003b405c16d86745b53e3a2be0d018113e3dea5b27e5d940658a24985f1994b
MD5 154339848025d81532fb8b11b846dd83
SHA1 be1c82c403fc0381fb52a5cf0ab57e0a21f253ca
SHA512 8f2602a469c837bdf6035076cbecbf3be12db4951822e4d91661d22f1be6ea541c709281b8a387f8e1984cfd83aa16dcf71c6ac8983d43889cc9f0ab9b500d6b
TLSH
T13BC012014192CA6E45045C0A19A9A7CCF4D508D92D49BFA14501885C53D2C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Aoc7fGfmjgbO.bat

Path C:\Users\Admin\AppData\Local\Temp\Aoc7fGfmjgbO.bat
Size 185B
SHA256 0088eda7ff93e3084a241bf407445e2122bd3e452ed35e7dde0e5e996d16161d
MD5 3c9375967f66a027f9132fe48536b352
SHA1 0d2b165657c772d68e913a13a46047bd3ee7a50f
SHA512 9db6ce3b94c8db749f55a1f7be6f7da200f89b639954baf0d64bb598f989085b665ecc4b08c9afabdc509e4ed0254f1b8b308788b15f9088baff78ec646f2168
TLSH
T11AC0120151858B9E46046C1B59AAA7CDF0E908992949BFA045418C9C17D2C68B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

Aojr6tFjKCge.bat

Path C:\Users\Admin\AppData\Local\Temp\Aojr6tFjKCge.bat
Size 185B
SHA256 2453b8c9576c57a3e03834dcd04653490df323e48173fe298c85ae7dad9053cf
MD5 37b43bea62ab283464c1baf31f68625a
SHA1 fda634a757434e29628c56e07068804e08c4c03f
SHA512 872c492a4761f53e5c91f98b7934b617591d37949019a784f2ec1917dcadb119d2bd886d62d0935a1bbd45c15553e7ae08ac1a2266fc639332492d9226c7f88f
TLSH
T186C012014185CA5F45045C4A59A9A7CDF09908992A49BFA08502889D23D3C98B9DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

Bb3L49YMqzuo.bat

Path C:\Users\Admin\AppData\Local\Temp\Bb3L49YMqzuo.bat
Size 185B
SHA256 b3f15314eb7a0ba935902a94f1c2b7c08e87454dfb8bc65d2722b6767705b6a7
MD5 c8649f448e2ad6e0466224999dd72ff0
SHA1 b835af1b9193272e21874ddbb52d2e90180284ba
SHA512 bff7438b585e2c4f024afff8accfd0bc8719b5daf1ab1c5bc77de63851c6ab5f23054d20635d7c3a5d366fba336efe524f7b39ede5dde64ae47b260d7800aecc
TLSH
T109C012015181CA6E56445C1A19EDA6CCF09508992D497FA04941885C13D2C5CB6DF792
MD5 SHA1 SHA512 TLSH

Submit Download

BqbYSgasagX8.bat

Path C:\Users\Admin\AppData\Local\Temp\BqbYSgasagX8.bat
Size 185B
SHA256 ff9539c8805bec58501dacad436d4acda9e2d8bc94dc0261c00e847c6d3eb0a0
MD5 f1249da2ae5618412962e00a44501006
SHA1 e34addbcbd34c6130aebe920d32e3c94c2e3ded3
SHA512 8be9949925874569ea6a2e07e9bbef60500e70842c1f2b9189fa8ec85216ec7bbee0e3d98b58ee3de0d82ecb6cac88a5c47ac8c0683a56efe9d9497d59f95d5f
TLSH
T152C012018285CA5F55045C1A19E9A68CF0D508EA6D49BFA04551C85D57D2C68F5CF783
MD5 SHA1 SHA512 TLSH

Submit Download

CClZzmnF8zP6.bat

Path C:\Users\Admin\AppData\Local\Temp\CClZzmnF8zP6.bat
Size 185B
SHA256 84cdcf1289fa421178584624357663b1a17a0234612ae1e40322fe22ab72e65b
MD5 ca97634f7897c5834e253251b9d4a6d3
SHA1 217e2f866e23f9928096c23076f787965f81a4ee
SHA512 3a11b3b7fd8c65228fbacf8d333a1a4503da7693e591d2ceabe2e666956c8dac344b80b2a32626de93b2427c7639134fb8aa2b9bb3709903403b0e5b1922856d
TLSH
T172C012018581CA5E46145C1B19E9A6CCF0E6089929497FA04A01C85C13D3C68B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

E4ajfIMka7C9.bat

Path C:\Users\Admin\AppData\Local\Temp\E4ajfIMka7C9.bat
Size 185B
SHA256 7b9c18bdc3d5eda8482fdd1b686016762f9b62d4c4fa4e6fd105417da8ca373b
MD5 4012dbecf8246c837f0ff8c14bfd4cf9
SHA1 dcf4dd5700f646464c3b1d7c010b10ddbe7dfe24
SHA512 c038d0a589e9182d025572db18847a03f7ec8e82cdd8e24ae78a6e4880327e1ac75e884c7c8b6d357d568c14d071fad414bdce6b43a4ebb55bc647f039f9fa17
TLSH
T164C0120152818A5E56045C1A19AA668CF1A5099D2D4D7FA44A12885C57D2C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

EuqsA1lp9bP7.bat

Path C:\Users\Admin\AppData\Local\Temp\EuqsA1lp9bP7.bat
Size 185B
SHA256 3721f6d308ca9eb0e19213101eff182c62e7ed2926f1e99485b97f73967dd09a
MD5 80bf0dbaac0dd250f7fa48daaa11aa4e
SHA1 0b44802ef3ff792445ff16a1a4fe95b353bc70e4
SHA512 2e7d6102a9a0b10c4ba339f169cf26e89937177b05fcbea1cbc32a2c5853082429ad2e2d5285ba22773d42c9627c5e6650397399ae10729bd429d4772b6cb516
TLSH
T168C012414182CA5E45045C0B19E9678CF0B608992949BFA04901C85C57D2C58B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Fm7xazVk4ZTQ.bat

Path C:\Users\Admin\AppData\Local\Temp\Fm7xazVk4ZTQ.bat
Size 185B
SHA256 cb68ce9b795ca808e32233180072408b1bf651d6a4c561d8b0a7e0b426bb221e
MD5 be551cd752e484d91576f45bb02c9ed1
SHA1 d6b4db9dab9d75aeeddd1e45d832ddea983f025f
SHA512 97c56fd6e087b63c3e3edde868dd14536c44da952d0c04f471e20132ef7eabacd634e4e0dcabc3a1d89e4f059752e9430452ca878439c76d32fbce089ca549de
TLSH
T127C0120191818A6E5A045C1B19A9668CF095089E6949BFA04A01885D13D3C59B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

GhEJkxYpxzap.bat

Path C:\Users\Admin\AppData\Local\Temp\GhEJkxYpxzap.bat
Size 185B
SHA256 440f9da4b8ed72835d5c95ecfc33ec6758b19459d604e7a33d747db2005fb7fe
MD5 ce2c5c2072f973060b4347f988aee270
SHA1 cfffa1a3b7131351222626b4bcc9f707b8aec8d5
SHA512 07f7ac63d5d530558737705956b9d05e31e0652093db882b010325c0c7e2fa8bbe583fe35f117fd9c88de971cfe152ea37f864692403b137dc8f3e01b8c99c9a
TLSH
T102C012018195CE5E45045C0A19E9B78CF09909A92949BFB44601885C17D3CA9B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

HYkJXwBTCG14.bat

Path C:\Users\Admin\AppData\Local\Temp\HYkJXwBTCG14.bat
Size 185B
SHA256 0a1e6dcbf0cb4e65570b3ba68fb17a7c33cfa3ff0901b443e06e5ef4ddf51d26
MD5 e67769420a893a46629f4377a047c9dc
SHA1 3515f3194a3d8536e9fc9179701f688228316346
SHA512 09c19386cfdaee42c82f164001d9dc95f32c43c5f96c7d5db97071259241558abdf954a0ed1b52a3009638b5a1befe2fb1d09f6074e629125a7add7864be1770
TLSH
T19AC0120185868A6E45145C0A19EA66CCF09508992949BFA04502C89C63D6C58B9DB792
MD5 SHA1 SHA512 TLSH

Submit Download

IbknriugfYeC.bat

Path C:\Users\Admin\AppData\Local\Temp\IbknriugfYeC.bat
Size 185B
SHA256 5890d26dda84a709df14182d4862688774928bbf3902dc17a3fe5e488ed79a77
MD5 6894fe1784c0068cb7e8c8d1de671b07
SHA1 e1401d78a6b548b632ee68fe4a43e5eb954b5871
SHA512 7f0a0fcd7ab4e086eaee79ae4f2f4f1a666146c1781f6a071cf0c5aa6e5a3841c65597871f983c859da6552f481d05ba83a74e324699c04c1a7a86905927d54e
TLSH
T112C0120145858A5E55045C0A19F9A78CF19508A9294DBFA44545885D13D3CA8B5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

Id4l77NBpjBf.bat

Path C:\Users\Admin\AppData\Local\Temp\Id4l77NBpjBf.bat
Size 185B
SHA256 e6b7b26a1e26a002ead46300ccabdc6a35604ebe533693a6eb19baf7fb5399e8
MD5 ab0202b4866af66f9df9eeaeeea532bf
SHA1 e1360d4f56e62be947ae7b2510594cd2bf868925
SHA512 5484d76c5e72475f3a0c16fccdda184eb463733a1e63b5e085cce48a5c82977f3b03acc137e566b344babba09d4e9fc5584f7286d322270c1b6facb8136ae8b2
TLSH
T116C0120142828A5E4A146C0A19FAB68CF1D609AD2A497FA04601885C23D6C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

LAQw7UURvQDy.bat

Path C:\Users\Admin\AppData\Local\Temp\LAQw7UURvQDy.bat
Size 185B
SHA256 2b9e1607dfa1aa764f881fd49bb721be36b0f5cb2032dfe08ce26d3b678d4500
MD5 6cdbab34049e8763acae480f3a7c52ac
SHA1 60f38288f574872dc29dd81400cc0578c4f6c49c
SHA512 04d55008ae77f50c14537381af32edb51aad77add4a3f072a34461435aa6381abe14c8dd4eadf7e7f8945345eb2561d9deafd2be4245675afd102a1a9ba556e0
TLSH
T186C0120185918A6E86045C1A19AA668CF19508A929497FA04901885C13D6C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

LC6TCxgQdarS.bat

Path C:\Users\Admin\AppData\Local\Temp\LC6TCxgQdarS.bat
Size 185B
SHA256 acbfaf48ed98ab397967d6d63aacf4aa4c617acf69a4a1c8fbc8325a81c68277
MD5 98445e7a83f17d5b3044d0c6c4320c52
SHA1 cc5c01d9bd74cf1f75d63690fef605c1b29f7884
SHA512 a0dc681b41aecca05050206437833b837db64166b2a34a3837204e7541a58a132a05e16f081fb3cf1f499d469244931d06c39df5c574ba7560e0512a5a79631d
TLSH
T162C0120182C68A6E49145C0B19A9668CF1D508A92949BFA44941C85E17D2C5CB5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Nb09mFHJYAiO.bat

Path C:\Users\Admin\AppData\Local\Temp\Nb09mFHJYAiO.bat
Size 185B
SHA256 f0141407c60dd0fa1446f649ed065508517900ab7dbaf9b291f25ca64e07b023
MD5 7965265c40e3b0495783a013a52e192a
SHA1 fedc68c2f63236b54ffea586343ca859e98a42da
SHA512 7399505809190d7c4cb89c78f2deccc5f103173676ceebc4ea46048eb5a46bbf2a9271a759d20e34fb299f9ad7f2cbae8521abd7ac63a39c3541ffcbbd67132d
TLSH
T1ABC0120192818A5E59045C0A19B9A79CF1D90C9939497FA44A02885D17D2C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

OjH3w1da4Lri.bat

Path C:\Users\Admin\AppData\Local\Temp\OjH3w1da4Lri.bat
Size 185B
SHA256 8a245bbe086faf3d3281944717ce2295a9dbef3336ee4f6963e68859ba67a318
MD5 0830969a7cc3beda249c768f3f9626d7
SHA1 654481de53b62a4322a862e1ed757a01ceab54b6
SHA512 fa7032360c9186d4c6e5f275dc4f6c9ca18b4052742b6655c9e24553ec5ec0e5a43eb94f2a31417875bafdb8be4864e448956f14b35f96b9c40cf21ce73e8991
TLSH
T1D1C0120151858A6E55045C0A19E9668DF0AA08AA2A49BFA44551885D13D6C5CB9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

QNQMZrAcxsCk.bat

Path C:\Users\Admin\AppData\Local\Temp\QNQMZrAcxsCk.bat
Size 185B
SHA256 fa906159f154a3b498134c6bfc8ddb158c59ab772abfd4013f1c346be0c59f45
MD5 7208960398d0f89663c56464fd28f7dd
SHA1 ca48d3ba481bcf0bf0164078decb2c579ea9f016
SHA512 473c33deb226ae3494c34ddeb884024525a102f4ba18bf2372a045a2f775b8ae6e292fc1f53c74d092f3e1c7fa8a7fd949ac0f7cf5b97fc3e25da0d51bf5aefe
TLSH
T1C5C012014182CA5E8B145C1A29ED768DF0A5089929497FA04511C85D17D6CA9F5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

QTNIDiz7g8kP.bat

Path C:\Users\Admin\AppData\Local\Temp\QTNIDiz7g8kP.bat
Size 185B
SHA256 7fa054520a5a51035b458b43b77f1ad79e9f2fc91a99dfefd6d5f2eaaf41fb9f
MD5 6d6d1732f2c7c0a64d5e315cc56addee
SHA1 397706afa669e885c89884ec90957c393c83acbd
SHA512 a77155dd7ac7df9146caa1bf198b3ef980ba4c0f7b80240d44eae70f79d4ba20fc5d47df902e8fd40cae1177ccda86fd2d7e3e47e50db0f2c425796746be169e
TLSH
T1EEC0120142818A5F4A045C1A59AA668CF09608AD2A4D7FA08601C85D23D7C58B5CF796
MD5 SHA1 SHA512 TLSH

Submit Download

RkjE8X34dJRf.bat

Path C:\Users\Admin\AppData\Local\Temp\RkjE8X34dJRf.bat
Size 185B
SHA256 457402742970dc7be3e29233851e67f61aa78403ca97d96856fa43732aca7552
MD5 0ccc363b52bb46e32df343767186969e
SHA1 2f879ca4041371e0709e99d50e8283fc4910eb0e
SHA512 2ea74e9e76da06f3ad01b847c09235142e894a64421923c80fb388e951fe9f044536b2dff7e522c06815a41b03c638415f2b901dc16f3f63fad45c218db1e8c0
TLSH
T10AC0120145868A6E45145C0A59E9B7CCF0A609A96A497FA045118C5C13D6CA8B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

SUVUz2rf9Sfk.bat

Path C:\Users\Admin\AppData\Local\Temp\SUVUz2rf9Sfk.bat
Size 185B
SHA256 956d5c266175ec2bb107c20a5a4a22c41bad7915e0b176d522049e6d3ecc4778
MD5 81f72836d81fd9f0ddf16eb0dded3b71
SHA1 1750a4eacd61f0bf477e519d24f172351469febf
SHA512 234fb8b0cdcade002b88f48efedeb8de2077578f37214d41fe292a2f2f9f7f5560f7c939f42c227b03efe53a579816875a8d6db4feded62202b9aa62133c8c97
TLSH
T114C012014585CA5E56045C0A29AA768CF1AA08992D49BFA44641889C17D6C68B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

SslvMaY2LXtg.bat

Path C:\Users\Admin\AppData\Local\Temp\SslvMaY2LXtg.bat
Size 185B
SHA256 ae7bc42526498f3367a98d80ba8a42981d0a816a324c10b19ab041c48a568a0b
MD5 8556f636c3f722fb88e094fdd2f64c11
SHA1 e817b6cd08661c93a72e1ce0bf543723409cc70e
SHA512 128cfb47e303e5e6b2997f74be78dfdb8a58d1fea365c40295623b79c4006696ad1269ef18b6496416e5beca9eb27099d7d30185233cfe78c607b36dc8e08fbc
TLSH
T1B5C012014191CA5E46185C0A19AD66CCF1D5089929497FA185038C5C13D3C98B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

TyusAmvOnCdb.bat

Path C:\Users\Admin\AppData\Local\Temp\TyusAmvOnCdb.bat
Size 185B
SHA256 fec3507350ba23e45d47b51be20836a84a144df54545ff6507881447cbc86bcb
MD5 3f9387b03febe3fbd2c40a8d290a637d
SHA1 0c0b693e31a619015340538b1b16b9ef320df212
SHA512 d809f2a36076cc646f9ad73d403e50a1343b601669f9c05ded9d3618ce5cbfc205fb0fb2a434b56e26d9cc93905e91f77901d24ed593cd522037f8db2eb8047c
TLSH
T18BC012014582CA5E59145C1A19A9A6CCF0D9099929497FA04A51C85D53D7C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

UaNRcEiRWWu4.bat

Path C:\Users\Admin\AppData\Local\Temp\UaNRcEiRWWu4.bat
Size 185B
SHA256 282507611bceef542be17d88715e98cc3659cd5fe848b26d0c9c0c750982767d
MD5 b95bf0fd902bd859564bbabb8ae510f8
SHA1 93dda68c06460e13fafd0b78275bc19220a3770f
SHA512 d8eb149d71661b269c0c061ca4d1e58bb3139cd1578bb960ec41aa1c59eb3b5db6cae681877c2e6a3e2c8879b7528447d73f3764e751b5a00e1a8ed476f0c413
TLSH
T137C0120141818A5E56045C0B59A9678DF195089D2949BFB04901889C23D2D98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Vn89sL7AJaei.bat

Path C:\Users\Admin\AppData\Local\Temp\Vn89sL7AJaei.bat
Size 185B
SHA256 1230b5b87a262a9abbe4f762fdc0b00d2651c92a39b143c0e2c6c28ad74c885b
MD5 3bcf34bc2a05608201738302c6619b7b
SHA1 4518842c411c2139fb5b1e49c131e9d74fe6478f
SHA512 b681cebcdc553a29e72cc4a1ca3fd24e3fdfe1a85a5d7a45b28617e9b148aef07e85a429a38a8e3414f51a7dd75dc19105c022282e0243f113dc93b381597386
TLSH
T177C0120142818E5E46045D0A59A9678CF1E9089929497FA48601885D23D6D68B5CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

VwxJeh9jTz2E.bat

Path C:\Users\Admin\AppData\Local\Temp\VwxJeh9jTz2E.bat
Size 185B
SHA256 466d9a12c012df38f498e27256b6c8b0f01d176b4e7ff9c574c2f3859cb81ebf
MD5 039a39111458d99aa5e308052e3ce13e
SHA1 e14e2e46b5dfcabecb9c406e4a366f26a19d312e
SHA512 406c1f310c890872f65ff68f4e745c2fbe2e6e1a53c3897a32462839ba3292ad5a6988fe8fb6326f94f7e79f66c941a96560a28125b11301975a52ac2f56b0d4
TLSH
T180C012018181CA5E46145C0E59E9678CF19508A92E497FA14A118C5C27D2C99B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

XcCxelKsvF3m.bat

Path C:\Users\Admin\AppData\Local\Temp\XcCxelKsvF3m.bat
Size 185B
SHA256 d921df9e9f2ddda680d61d292db296f052581a8712fe5bdf01e544ed853bb033
MD5 8f8e01b83f8459615cab5f102a4e4048
SHA1 f6e599e73d694e19fed6df6bfe6753e359783656
SHA512 b39e757335bcfd30fcb192d357dbd4e91fbbb6a1b77acffd23f1d8a96375a772394bc767e34cd854029c5f37f7059eb23e02bfaec5fe920b81511b18f95a9dc4
TLSH
T115C022008181CA1E8A000C0A28A962CCF0A5089C29487FA00500884C23C3C58B4CF382
MD5 SHA1 SHA512 TLSH

Submit Download

Yl1piYBWO5UT.bat

Path C:\Users\Admin\AppData\Local\Temp\Yl1piYBWO5UT.bat
Size 185B
SHA256 bc4d1fa9dc4cec0eec650b1ce1f8b0db53df7c4ccd3c5638e2efa0ce2300239c
MD5 8e6d5338a6970212b3fbd1441c13d126
SHA1 2a0f1bf763135a1e27fe9ef598678cf46d07e02c
SHA512 f889f4bd906cea7d3303c16e75ee56cf09c10779734cc3e9236896c25850e7b5798ae5337eec02a3fe233299732492302242031742d942dec9232df009bcb340
TLSH
T133C0120185818A5E49045D0A59ED668CF0E608AD2A49BFA14551885C27D3C68B5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

YlgJlcu54YwM.bat

Path C:\Users\Admin\AppData\Local\Temp\YlgJlcu54YwM.bat
Size 185B
SHA256 77fee87d214a68551df2817eee0e61fa694bad29059c881eaabc0f0081d4c0ac
MD5 793ffab1cd109815cc59b6e921f35eea
SHA1 9edf45c1cb90f9f603111d6cb49e6af0dd2c203b
SHA512 e67e0af123ad35742e88a0c78e00e77d8c19dedda91cc983a17b6b47aece347652bbc342c99ecb55154552eb58f4e175f4f1e742253c424c8dae10b09e0e10fc
TLSH
T19CC0120186818A5E49055C0E19E9B6CCF1A5089D69497FB44501885C13D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ZgzrDfbKi3VQ.bat

Path C:\Users\Admin\AppData\Local\Temp\ZgzrDfbKi3VQ.bat
Size 185B
SHA256 6dac79c81be39f06a9fe7974293edc79b2751d28f249a6aee82b903493966417
MD5 0d55c6b9f137e722f4aebcefa2fa8d22
SHA1 25df099dade88ccd9745d0d8470077712a887385
SHA512 11b7072e703fb3ee3320f925ee6997a171e0f643abb8f0efcbb363dac4044f19999fae18b04f9d91cd44430957f71393bb1064492fee8c75126a71ed3ee1a482
TLSH
T1A4C0120141828A5E45045C0A19EABB8CF0E9089D294DBFA04541886D13D6C58B9CF792
MD5 SHA1 SHA512 TLSH

Submit Download

ZysRvibT941f.bat

Path C:\Users\Admin\AppData\Local\Temp\ZysRvibT941f.bat
Size 185B
SHA256 0243b3259895919a2c7fdadee75c548e5a66d5716c501d5d1e878815cdb2138c
MD5 2c60f6f2a6c1834081a915b1b1b64b2e
SHA1 0367e3f811172f4fb6c8da0b04a3a0cbfaa05835
SHA512 2623ec9e9eb962135f888a76bcb38400e23811e9a276e7fe9c3d2123a6677f4407a2ac90a7441b295a50de26ba10c59ad42e991978cecb12c4f64990d0707b23
TLSH
T159C0120141828A5F45145C1A1AE9768CF09909992E4D7FA04611885C23D3D68B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

bP1AdWIHPNmn.bat

Path C:\Users\Admin\AppData\Local\Temp\bP1AdWIHPNmn.bat
Size 185B
SHA256 7e69571b704052717fc79c6a447a4eb54ef893fd3f39248ccecdf4a0430a6b75
MD5 49fbe7d8b92c3954f6d578202f685fa9
SHA1 d804acb0f5624aa37f7ff471584d8a0c9fab84d5
SHA512 e9f9f5596620f7b77268ebd03a138e7536d56e725b221a9a378af412c464deef0ee60488e74b275745fc3b620c9c1e7120284e56d1d77ddf1d13ae4a1a13194f
TLSH
T126C012014291CA5E55045C1A59A966CCF09508E929497FA445118C5C27D7C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

blUrbf3XSjj1.bat

Path C:\Users\Admin\AppData\Local\Temp\blUrbf3XSjj1.bat
Size 185B
SHA256 eacbb9d6ffcfff775966c16cd7cb6cb431d797851930891def53dd71a5136d32
MD5 7f14b009e7b459db365a82c3b3aa3e86
SHA1 567e9c499dadf4511aa8c901c17f34f306f80151
SHA512 aaae4e557efc9dc75e4e1c952e25709591ac559ea0c8787fb9b0dd55c09e131207f4d2aba048cc8192cfaa14c60a52dabfb4c3dca474f2b2cf6dfbf959c227e2
TLSH
T139C012015281CA7E55055C0B1DE9A68CF0A5089D2949BFA04542C85D67D2CA8B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

cKHjzGBS2JYx.bat

Path C:\Users\Admin\AppData\Local\Temp\cKHjzGBS2JYx.bat
Size 185B
SHA256 52d9abb428f2dece6c55b6e0e8f9d287417c8983dc4cc24a078097dc784eaeda
MD5 5e1c77c639833d6cf592dad7619b74ca
SHA1 e9d587c5cb96379158fb29345f195387db4f13d8
SHA512 b62dc2b4686402f73f060998df769110c2fb7929e7f5998f04f0a20b95949cbd6f7034f31ceebae4b9954889dc292a3096fa8900a3be377139b1e3c6d95a7426
TLSH
T1C0C0120185828A5E85045C0A19A9768CF0E6089D29497FA14A01885C13D2C98B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

cZr9tTSXjXoi.bat

Path C:\Users\Admin\AppData\Local\Temp\cZr9tTSXjXoi.bat
Size 185B
SHA256 0212c7012aee25a85431ea02e74069224cebf236587d25e9fa818bd155aa8684
MD5 1b06b212f46026ad98a5f4e2fbba9799
SHA1 5ec0c7011136c58896bbd9c6ae22bfa06dcfa4cb
SHA512 109dcce03a90834ef0c24db0cd77e9871cc44509d93d9e062f6eeef410acb9347526056baa0a2f57f264d783cb09cc3e677be10a709bd43cce41e4b69b79e2a8
TLSH
T1B9C0120191868A9E45145D0A19A9768CF099089D298A7FA14911885C63D6C6CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

dewRDx4RADY7.bat

Path C:\Users\Admin\AppData\Local\Temp\dewRDx4RADY7.bat
Size 185B
SHA256 f6277c47faeba208f84fb68c3a1bb53cd978cd41a8c2d0d6aa4ddc150f10cc77
MD5 8e251bf63630f855c9adcc4c0c1de602
SHA1 6b6b224aeeaaa5d69b8ece51c32ebeae9db16165
SHA512 5a928bf4f92174adeb696428a16758b763514c4a5c394203dfd29417e8c6fd3b90ca5ddf3e8c38a17fa651a972420535e3b1dc3588118db4c55e6d18dc130993
TLSH
T113C0120185918A5E45445C0A19A9768CF0A6099969497FA44542885D27D2C98F5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

f8zQlY3r6kCo.bat

Path C:\Users\Admin\AppData\Local\Temp\f8zQlY3r6kCo.bat
Size 185B
SHA256 bf8817beb47b9b1fef299c29232654c79c9dc2c1c34da6cd7e2432b019012272
MD5 cc0400ca287f02c7e8cb7b3ff3fee01f
SHA1 b8d1c0d60e70886aca516a80f0318c4d1ff8a163
SHA512 6aa0cc8e5256462be933928589558b7cb84b470f95617a5406cdc4fa6c000f2f8ddce6d6095f805076b4fd16686e910911c950144b9b5af60a01c439c1b44873
TLSH
T14DC0120241818A5E4A045C0B19A966CCF09509997D497FA04551885C13D6C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

fR14cFM4PdQd.bat

Path C:\Users\Admin\AppData\Local\Temp\fR14cFM4PdQd.bat
Size 185B
SHA256 4b0f14d2425c838ed145ef3d3a70f5d038eb843bfa3a2682515edeb533fba2e7
MD5 377a3cbc2fb741fc913345743cb47afa
SHA1 587bf4a083c5174dee74c7d80388a04bac9cea52
SHA512 c7d89a9ea0cfe9abdedaa9a302d6c15d3e579a230192a4504e0b360913e3f5e7c355d7ea02d9547dda969ff903d21b4d19e836d01609dd248e090e9b051dac1e
TLSH
T181C0120141918A5E46145C1A19ADA68CF095099969497FE04A018C5C57E2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

jR6kIequiLjc.bat

Path C:\Users\Admin\AppData\Local\Temp\jR6kIequiLjc.bat
Size 185B
SHA256 520cb6d6d839cf94cfddf9dd0c344050c4c8e6a79d6ce6635a781f7599d3c85e
MD5 38f8b11248d0ed9f28fd12debe7590eb
SHA1 fc90ef40c160a346096848c12b37465973506993
SHA512 763e490b2a0ac54a510852890a911c5cb6bfa1b4569cdb2028a28a1b1eaddbe2ca7a14c36905f3ccfd07f10fc60a93110c42f8148aa70501cbd1fde11ae741a1
TLSH
T156C012015581CA6E59045C0A19E9668CF096099D6A497FF14541889D53D3C98B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

mZGZiIlkhZCT.bat

Path C:\Users\Admin\AppData\Local\Temp\mZGZiIlkhZCT.bat
Size 185B
SHA256 e5311684123a07dd43e6a42d12228070c372622cb6c7bd127ca221953018ff0e
MD5 5dc55830de076bc4e9c807933e1e2fc4
SHA1 3f88449981f56fb3a8d63fe943cc8aa3962bff52
SHA512 ca3457f505de7919e155286076ef863557734775fe959b10cee25235327c45e9930e3f56b4454017ee4de9f3e47f947ebc7f63c6abcf6e05625d507343e510f8
TLSH
T12DC0120146828E5E45045C0A5AE9768CF09508996A49BFA14515889C27D7C5EB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

mZbUCuJWSsED.bat

Path C:\Users\Admin\AppData\Local\Temp\mZbUCuJWSsED.bat
Size 185B
SHA256 177bcdad79a59ce7ef39738d7f5070786ebb87154566225a6354a8403d794910
MD5 edc918d6e7f8998c465a2c241f0d4777
SHA1 25d0ccad7b45e63e139832cda02b906f46e97753
SHA512 b55148e6843c7dc03bbddc7848467842cd53560b3d0c0a8bfc0fbf4cbb988a0f8a34712cac414c3f1d8e42ae2bad81ccc0c0c9992a323bebb314a1ec6b52ab44
TLSH
T191C0120141828B5E45145C1A19E9768DF09909A969497FA04502885C63D3C5CB5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

mhsMc4N1qXyc.bat

Path C:\Users\Admin\AppData\Local\Temp\mhsMc4N1qXyc.bat
Size 185B
SHA256 ea297a3dead7867eee0706b0dfdce38f40938a3966c5da5f0eeb746efd29450e
MD5 1b8384661bc214ff5017838bf00e4c95
SHA1 330fdc94f07ad33decde74a86e22ca23fe706589
SHA512 23b16f91da9f9428888448bedb827eb84755eb7417859d630db1d0caf28936c3e7fa857a5b578dd8c972e9b960699c83da8b128cd18e61f73cfe31cbb3a5b0e9
TLSH
T137C012018581CA5E56245C1A19E9A68CF09508A96E4A7FA44501C85C57D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

nDABnJvs4bmL.bat

Path C:\Users\Admin\AppData\Local\Temp\nDABnJvs4bmL.bat
Size 185B
SHA256 4409e78831ef4a008237a1903621654c565f72e9faf4230c89b7bfdcdfebd74b
MD5 3a44fa4bd2ae37aab7b4077e41e4e5b2
SHA1 1d7a38c00ccb828dafb2d41ee5d95ca440542130
SHA512 0032fbe4ce7e76d947ddba3d21bc7f926a085c263a0c29005d8e8fc631f2f349c73fc5cfee3d81b29c3a0fa97c508b418e80064beee769aba950728ea73d851f
TLSH
T122C0120146838A5E55045C0A19AA678CF0A5089D69497FE04901885D17D7C58B5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

nliLVdsMMCjK.bat

Path C:\Users\Admin\AppData\Local\Temp\nliLVdsMMCjK.bat
Size 185B
SHA256 1836fc8da181b0dfc5c6ce54173c1267256a460ccdd8e011c85604cbb6388b35
MD5 f08ba25a2f6464a29bdf115285e53c69
SHA1 81a7197b5c876a7197300cb3ea876144c894ca80
SHA512 0d3a42e9423e76d45b309b614c0ca7605c3a934ad10a7863cf1962eae8861293bd8f0be58db117e3ba25bc86df5a9ee315960db93865322a9030841177cce8ff
TLSH
T1E6C012018282CE5E4A045C0A59EAA78CF0A508A92D497FA04511885D13D6C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

oJf0ZQLFk0k7.bat

Path C:\Users\Admin\AppData\Local\Temp\oJf0ZQLFk0k7.bat
Size 185B
SHA256 f6a049aa925c5246f2f9a9d10d51b9d6ded196d6f5bba03ca5217ad6e71e0c96
MD5 4196999cd46e4f26d2a9d42a735df611
SHA1 112c384658641f68f4b28e19d3302cb450976234
SHA512 cef66f6e1ff7756c9c531efa50dc9c45adb3d6fbd2ee22cce57c9d1a207359a5f2fbe663f6159bc01945444974ace838bf783a638734c414ecd3187a5a6299e0
TLSH
T17CC0120241858A5E45145C0A19ABA6CCF0A508D96D497FA04911C85C13D7C5CB5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

oPGYUHvYS7nZ.bat

Path C:\Users\Admin\AppData\Local\Temp\oPGYUHvYS7nZ.bat
Size 185B
SHA256 758d684b2d8d8e30f8369ca878144827bee484439718c835d61621a720f3d741
MD5 1328a084b4653d52551ac0bcead5223c
SHA1 08e87f55561a8d322c143920289b90ca2e48fb53
SHA512 6341fa902cfa874e33d6286d375d44d3172f5e0cb9ed72b3330752b76a57cf5f4a15391865d8d401d2e3bb2f3402fa934e93392efe77ecbeb30a5a46eba0a8ee
TLSH
T128C0120145828A5E4A045C0A19A9768CF0A50C992E497FB085018C9C13D7D6CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

p28uIbbowD1B.bat

Path C:\Users\Admin\AppData\Local\Temp\p28uIbbowD1B.bat
Size 185B
SHA256 586b46e1826ad92596f584ad414011cef4bc4d59dc73e25df2b5acb182968193
MD5 d28a0e2c5fa1fd4e46d3e6a7241f9108
SHA1 1ceb3a130a9e2d8fffac5545d42a089f098f4a5d
SHA512 d0668d46b36933b96a6dc3e35cb4785b488bbb10f6d7aa15eb51ee5a529e154c34d3d988ad603c5d9f644f840a0a2fb1bbddc1576e4535f28093713a7b3600f9
TLSH
T1A8C0120145868A5E45045C0A1AADB68CF0950CAD69497FA44A01885C27D6C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

p6uU879agVh2.bat

Path C:\Users\Admin\AppData\Local\Temp\p6uU879agVh2.bat
Size 185B
SHA256 3f8d02c55f9e8c84b6200cb265905ef345c2e3ba7b0ff689552d5c8c75de0125
MD5 deea63167ae7c9aadd1e10e451c5b677
SHA1 d510042ed393025691561f2c4877a39772ecd68c
SHA512 28e5cdb621c757e434772932eb34808ca6c6515581a19a380228540b43e7f23f312e1092f797312fe0eccd48f1bace258ca8aed15a61a65d1f0764177c05825c
TLSH
T1E7C0120151818A5E59045C0A59A966CCF09609A92959FFA04901C85C17D3C58B9DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

rcv3oz3Im1hE.bat

Path C:\Users\Admin\AppData\Local\Temp\rcv3oz3Im1hE.bat
Size 185B
SHA256 3e67d8ecc1f9e296ec8e8ac031c77b1e69d09826d80ddfd191067bf09ea47f59
MD5 a0c4a616f57f7197baa18e1c7ec4501f
SHA1 aa479d20bf823c63a13f1450fbbcd6819e7b01ba
SHA512 e4b75128366bca0aa3433e37c2c04f75cb9ae1f969a8f11b3455f6ebbc68e1dc0b237a2dc496568511b7a4d27d13c09fe3b11b5bdf3b151c2047eb17f6b28496
TLSH
T180C012028281CB6E49045C1A59A9678CF0D5089A2A49BFA04911885C17D6C99B5DB786
MD5 SHA1 SHA512 TLSH

Submit Download

rz7nIZCMJmJ2.bat

Path C:\Users\Admin\AppData\Local\Temp\rz7nIZCMJmJ2.bat
Size 185B
SHA256 58dcb5996ec45db663a41c8af506b4ad25a4abee212d78cf0e7dc99bff9a7301
MD5 8b992c9ec8833615e91c0a019234178b
SHA1 c1e3a0a70f8b10aec79fcd57737a8a1e95b2a938
SHA512 e2714aac2027f3eb80ceaae514265439adb58dadc04fa7302db4eaa3b34f5a94ba34220e5702ed0911598195de6b3ffaba64990cc010a4ab13ae4d61bbfd0f33
TLSH
T13FC012014282CA5E85145C2A69A9A7CCF195099E2E497FA04501C85C53D3C58B9DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

s36GBIKDgbCb.bat

Path C:\Users\Admin\AppData\Local\Temp\s36GBIKDgbCb.bat
Size 185B
SHA256 3516621966a18d40e69dbcfb0bb695a80a069ba7b8da0e6c6b52844acf256f1a
MD5 be6b9b5da84c3d33e8d85492fa6b0774
SHA1 172d96e28397205bc15119a99d7cb266e9109d4c
SHA512 6c0ca89f23df308adcbd386f21abeb01eb229c41289a7c2772901bff76d06cfbb484bd572da8d0a32bf1a43b42fef738bcd2cbf8d9f3f64113043d8c51fad78e
TLSH
T1A7C080018192CA6E45045C1B19E9B7CCF0D5089D2D497FA04615CCAD53D3C5CB9CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

s4WsB7P29pO2.bat

Path C:\Users\Admin\AppData\Local\Temp\s4WsB7P29pO2.bat
Size 185B
SHA256 1986008351b63b39e90432cde741c044083ed8641a1a1cc557e892d026268bb1
MD5 f4207afd964ea54aebf53ab89b0082cf
SHA1 460a5b3ec643bbcc8aeeb625b3da6e96bb96cc5c
SHA512 12d48684c00e71a28f998a59eba6894cdefa81bea8046664113831f0d2f044ceabb41a7d5cb69d92955923df4cc8092f5efc5ba9b2fe6af09d81c2dbc86b0576
TLSH
T119C012015281CA5E46045C1A1DAA668CF1D908A92A497FB446528C6C53D6C5CB5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

tTqpRluxUPtX.bat

Path C:\Users\Admin\AppData\Local\Temp\tTqpRluxUPtX.bat
Size 185B
SHA256 63575b5ba6a195af52e28ebcbc8473973bf301bb19c5f5b1c366caf5a91e7f25
MD5 37af065980499024190f7490e472c00d
SHA1 77293685557ce7f917ce59d309b38a7f4ea800a6
SHA512 d2dc27236b60623c5a8c733c08a22e5114dfc43cc4c3ecef2cdbc08fb8d5625df89b8a66632f1811df4cc91e17021164a9b24c883ebd0b93b974cabb6385a73e
TLSH
T1DAC012018185CE5E55085C0A19A9668CF0D508A969497FA04A11C85C13D2CA8B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

uVkvwVyMhStf.bat

Path C:\Users\Admin\AppData\Local\Temp\uVkvwVyMhStf.bat
Size 185B
SHA256 d38452fc3806d3527df49a4b817348cbe1295829c056ac8c92f169b9317d55eb
MD5 1d9d4724c0513328cd543cbbec02444f
SHA1 1912465f156651010be1344235b23c30d1ab0fa0
SHA512 973a9294ff413d353964198abbce503b3e5a04a6a5ae2bb9a0932af22e1fc7266d43ee1cf2040cf15d7f88dcf231179f8c126651e7a88aec0b84f653e7f0313b
TLSH
T150C0124242918A5E45045C0A19AAA78CF0D608996949BFA04501885C53D2CA9B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-92-0x0000000001970000-0x000000000197C000-memory.dmp

Download

memory/224-93-0x0000000003130000-0x0000000003142000-memory.dmp

Download

memory/224-94-0x000000001BB70000-0x000000001BBDF000-memory.dmp

Download

memory/960-44-0x0000000002660000-0x0000000002672000-memory.dmp

Download

memory/960-43-0x0000000002650000-0x000000000265C000-memory.dmp

Download

memory/960-45-0x000000001B400000-0x000000001B46F000-memory.dmp

Download

memory/1216-155-0x0000000001910000-0x000000000191C000-memory.dmp

Download

memory/1588-128-0x0000000002320000-0x0000000002332000-memory.dmp

Download

memory/1588-127-0x0000000002310000-0x000000000231C000-memory.dmp

Download

memory/1588-129-0x0000000002350000-0x00000000023BF000-memory.dmp

Download

memory/2024-113-0x0000000001450000-0x000000000145C000-memory.dmp

Download

memory/2024-114-0x0000000001460000-0x0000000001472000-memory.dmp

Download

memory/2024-115-0x0000000002C60000-0x0000000002CCF000-memory.dmp

Download

memory/2076-30-0x0000000001C30000-0x0000000001C42000-memory.dmp

Download

memory/2076-29-0x0000000001A00000-0x0000000001A0C000-memory.dmp

Download

memory/2076-31-0x0000000003550000-0x00000000035BF000-memory.dmp

Download

memory/2260-100-0x0000000001AD0000-0x0000000001AE2000-memory.dmp

Download

memory/2260-101-0x0000000001B00000-0x0000000001B6F000-memory.dmp

Download

memory/2260-99-0x0000000001AB0000-0x0000000001ABC000-memory.dmp

Download

memory/2272-22-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Download

memory/2272-23-0x0000000000B70000-0x0000000000B82000-memory.dmp

Download

memory/2272-24-0x0000000000BE0000-0x0000000000C4F000-memory.dmp

Download

memory/2360-135-0x0000000001120000-0x0000000001132000-memory.dmp

Download

memory/2360-136-0x00000000029F0000-0x0000000002A5F000-memory.dmp

Download

memory/2360-134-0x00000000010F0000-0x00000000010FC000-memory.dmp

Download

memory/2456-73-0x0000000001A50000-0x0000000001ABF000-memory.dmp

Download

memory/2456-72-0x0000000001A30000-0x0000000001A42000-memory.dmp

Download

memory/2456-71-0x00000000019F0000-0x00000000019FC000-memory.dmp

Download

memory/2648-38-0x0000000002900000-0x000000000296F000-memory.dmp

Download

memory/2648-36-0x0000000002870000-0x000000000287C000-memory.dmp

Download

memory/2648-37-0x0000000002880000-0x0000000002892000-memory.dmp

Download

memory/3516-50-0x0000000002780000-0x000000000278C000-memory.dmp

Download

memory/3516-51-0x0000000002790000-0x00000000027A2000-memory.dmp

Download

memory/3516-52-0x00000000027C0000-0x000000000282F000-memory.dmp

Download

memory/3952-86-0x0000000003300000-0x0000000003312000-memory.dmp

Download

memory/3952-85-0x00000000032F0000-0x00000000032FC000-memory.dmp

Download

memory/3952-87-0x000000001BD90000-0x000000001BDFF000-memory.dmp

Download

memory/4724-143-0x000000001BFC0000-0x000000001C02F000-memory.dmp

Download

memory/4724-142-0x0000000001640000-0x0000000001652000-memory.dmp

Download

memory/4724-141-0x0000000001630000-0x000000000163C000-memory.dmp

Download

memory/4744-106-0x0000000001BD0000-0x0000000001BDC000-memory.dmp

Download

memory/4744-108-0x00000000033D0000-0x000000000343F000-memory.dmp

Download

memory/4744-107-0x0000000001BE0000-0x0000000001BF2000-memory.dmp

Download

memory/4944-6-0x0000000001680000-0x000000000168C000-memory.dmp

Download

memory/4944-8-0x000000001BAE0000-0x000000001BB4F000-memory.dmp

Download

memory/4944-7-0x0000000001690000-0x00000000016A2000-memory.dmp

Download

memory/4944-1-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/4944-0-0x0000000000C30000-0x0000000000F5C000-memory.dmp

Download

memory/4956-57-0x0000000001240000-0x000000000124C000-memory.dmp

Download

memory/4956-59-0x00000000012A0000-0x000000000130F000-memory.dmp

Download

memory/4956-58-0x0000000001250000-0x0000000001262000-memory.dmp

Download

memory/5040-148-0x0000000001420000-0x000000000142C000-memory.dmp

Download

memory/5040-149-0x0000000001640000-0x0000000001652000-memory.dmp

Download

memory/5040-150-0x0000000002F40000-0x0000000002FAF000-memory.dmp

Download

memory/5048-17-0x000000001B660000-0x000000001B6CF000-memory.dmp

Download

memory/5048-15-0x0000000001170000-0x000000000117C000-memory.dmp

Download

memory/5048-16-0x0000000001180000-0x0000000001192000-memory.dmp

Download

memory/5048-11-0x0000000002B20000-0x0000000002B30000-memory.dmp

Download

memory/5340-65-0x00000000010E0000-0x00000000010F2000-memory.dmp

Download

memory/5340-66-0x0000000001110000-0x000000000117F000-memory.dmp

Download

memory/5340-64-0x00000000010D0000-0x00000000010DC000-memory.dmp

Download

memory/5808-78-0x0000000001150000-0x000000000115C000-memory.dmp

Download

memory/5808-80-0x0000000002AC0000-0x0000000002B2F000-memory.dmp

Download

memory/5808-79-0x0000000002A10000-0x0000000002A22000-memory.dmp

Download

memory/5988-122-0x000000001C080000-0x000000001C0EF000-memory.dmp

Download

memory/5988-121-0x0000000003220000-0x0000000003232000-memory.dmp

Download

memory/5988-120-0x0000000003210000-0x000000000321C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads