quasar | a00583eac7cf6b9f866ac599ee926c61708bd89c42719326fe8c44ea877a2dea

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260408-dektcsfz9k
SHA256 a00583eac7cf6b9f866ac599ee926c61708bd89c42719326fe8c44ea877a2dea
MD5 3907f07d42d3dc0c7dfcef79551ce725
SHA1 3b9a1f810dba5705b2c89d7ac6fb87079618a9a2
SHA512 ae0c74f64ac7e8e9f2ecf656d38d491e475f56c94ce78db6b425bb96d9b4f10572c9619582e317fdb7dacee836d0a679f9f86b41f38d58af35626b2fb8c6e60f
SSDEEP 49152:QyhJJHPNCC7J98vBgJh99oG4znXKWxUuxGnTHHB72eh2NT:QyhrHPh7J98vGJh99tWx
TLSH
T1F7E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

tooteko.com
malware.tooteko.com

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3196-0-0x00000000008B0000-0x0000000000BDC000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	messenger_update.exe
Token: SeDebugPrivilege	4356	messenger_update.exe
Token: SeDebugPrivilege	2556	messenger_update.exe
Token: SeDebugPrivilege	2704	messenger_update.exe
Token: SeDebugPrivilege	5280	messenger_update.exe
Token: SeDebugPrivilege	464	messenger_update.exe
Token: SeDebugPrivilege	1204	messenger_update.exe
Token: SeDebugPrivilege	3580	messenger_update.exe
Token: SeDebugPrivilege	2460	messenger_update.exe
Token: SeDebugPrivilege	1096	messenger_update.exe
Token: SeDebugPrivilege	5596	messenger_update.exe
Token: SeDebugPrivilege	5784	messenger_update.exe
Token: SeDebugPrivilege	5708	messenger_update.exe
Token: SeDebugPrivilege	4092	messenger_update.exe
Token: SeDebugPrivilege	2232	messenger_update.exe
Token: SeDebugPrivilege	5556	messenger_update.exe
Token: SeDebugPrivilege	4104	messenger_update.exe
Token: SeDebugPrivilege	4912	messenger_update.exe
Token: SeDebugPrivilege	5096	messenger_update.exe
Token: SeDebugPrivilege	5188	messenger_update.exe
Token: SeDebugPrivilege	4512	messenger_update.exe
Token: SeDebugPrivilege	2496	messenger_update.exe
Token: SeDebugPrivilege	5580	messenger_update.exe
Token: SeDebugPrivilege	5496	messenger_update.exe
Token: SeDebugPrivilege	5848	messenger_update.exe
Token: SeDebugPrivilege	6140	messenger_update.exe
Token: SeDebugPrivilege	2780	messenger_update.exe
Token: SeDebugPrivilege	5348	messenger_update.exe
Token: SeDebugPrivilege	2908	messenger_update.exe
Token: SeDebugPrivilege	568	messenger_update.exe
Token: SeDebugPrivilege	5352	messenger_update.exe
Token: SeDebugPrivilege	3320	messenger_update.exe
Token: SeDebugPrivilege	2388	messenger_update.exe
Token: SeDebugPrivilege	5688	messenger_update.exe
Token: SeDebugPrivilege	2036	messenger_update.exe
Token: SeDebugPrivilege	4740	messenger_update.exe
Token: SeDebugPrivilege	4272	messenger_update.exe
Token: SeDebugPrivilege	5880	messenger_update.exe
Token: SeDebugPrivilege	2744	messenger_update.exe
Token: SeDebugPrivilege	3540	messenger_update.exe
Token: SeDebugPrivilege	1800	messenger_update.exe
Token: SeDebugPrivilege	3556	messenger_update.exe
Token: SeDebugPrivilege	3572	messenger_update.exe
Token: SeDebugPrivilege	3328	messenger_update.exe
Token: SeDebugPrivilege	592	messenger_update.exe
Token: SeDebugPrivilege	3544	messenger_update.exe
Token: SeDebugPrivilege	840	messenger_update.exe
Token: SeDebugPrivilege	2748	messenger_update.exe
Token: SeDebugPrivilege	1636	messenger_update.exe
Token: SeDebugPrivilege	2096	messenger_update.exe
Token: SeDebugPrivilege	2528	messenger_update.exe
Token: SeDebugPrivilege	4936	messenger_update.exe
Token: SeDebugPrivilege	3164	messenger_update.exe
Token: SeDebugPrivilege	4688	messenger_update.exe
Token: SeDebugPrivilege	4524	messenger_update.exe
Token: SeDebugPrivilege	4680	messenger_update.exe
Token: SeDebugPrivilege	2664	messenger_update.exe
Token: SeDebugPrivilege	396	messenger_update.exe
Token: SeDebugPrivilege	4340	messenger_update.exe
Token: SeDebugPrivilege	5936	messenger_update.exe
Token: SeDebugPrivilege	2412	messenger_update.exe
Token: SeDebugPrivilege	3476	messenger_update.exe
Token: SeDebugPrivilege	1592	messenger_update.exe
Token: SeDebugPrivilege	1720	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4296	3196	messenger_update.exe	80
PID 4296 wrote to memory of 5032	4296	cmd.exe	82
PID 4296 wrote to memory of 4356	4296	cmd.exe	83
PID 4356 wrote to memory of 4368	4356	messenger_update.exe	84
PID 4368 wrote to memory of 5884	4368	cmd.exe	86
PID 4368 wrote to memory of 2556	4368	cmd.exe	87
PID 2556 wrote to memory of 4516	2556	messenger_update.exe	88
PID 4516 wrote to memory of 5116	4516	cmd.exe	90
PID 4516 wrote to memory of 2704	4516	cmd.exe	91
PID 2704 wrote to memory of 3232	2704	messenger_update.exe	92
PID 3232 wrote to memory of 5264	3232	cmd.exe	94
PID 3232 wrote to memory of 5280	3232	cmd.exe	95
PID 5280 wrote to memory of 480	5280	messenger_update.exe	96
PID 480 wrote to memory of 740	480	cmd.exe	98
PID 480 wrote to memory of 464	480	cmd.exe	99
PID 464 wrote to memory of 5840	464	messenger_update.exe	100
PID 5840 wrote to memory of 6032	5840	cmd.exe	102
PID 5840 wrote to memory of 1204	5840	cmd.exe	103
PID 1204 wrote to memory of 3816	1204	messenger_update.exe	104
PID 3816 wrote to memory of 5024	3816	cmd.exe	106
PID 3816 wrote to memory of 3580	3816	cmd.exe	107
PID 3580 wrote to memory of 4660	3580	messenger_update.exe	108
PID 4660 wrote to memory of 2080	4660	cmd.exe	110
PID 4660 wrote to memory of 2460	4660	cmd.exe	111
PID 2460 wrote to memory of 2016	2460	messenger_update.exe	112
PID 2016 wrote to memory of 540	2016	cmd.exe	114
PID 2016 wrote to memory of 1096	2016	cmd.exe	115
PID 1096 wrote to memory of 1700	1096	messenger_update.exe	116
PID 1700 wrote to memory of 6004	1700	cmd.exe	118
PID 1700 wrote to memory of 5596	1700	cmd.exe	119
PID 5596 wrote to memory of 1284	5596	messenger_update.exe	120
PID 1284 wrote to memory of 5548	1284	cmd.exe	122
PID 1284 wrote to memory of 5784	1284	cmd.exe	123
PID 5784 wrote to memory of 5520	5784	messenger_update.exe	124
PID 5520 wrote to memory of 1752	5520	cmd.exe	126
PID 5520 wrote to memory of 5708	5520	cmd.exe	127
PID 5708 wrote to memory of 240	5708	messenger_update.exe	128
PID 240 wrote to memory of 3960	240	cmd.exe	130
PID 240 wrote to memory of 4092	240	cmd.exe	131
PID 4092 wrote to memory of 2712	4092	messenger_update.exe	132
PID 2712 wrote to memory of 5472	2712	cmd.exe	134
PID 2712 wrote to memory of 2232	2712	cmd.exe	135
PID 2232 wrote to memory of 5504	2232	messenger_update.exe	136
PID 5504 wrote to memory of 1040	5504	cmd.exe	138
PID 5504 wrote to memory of 5556	5504	cmd.exe	139
PID 5556 wrote to memory of 3296	5556	messenger_update.exe	140
PID 3296 wrote to memory of 3408	3296	cmd.exe	142
PID 3296 wrote to memory of 4104	3296	cmd.exe	143
PID 4104 wrote to memory of 5712	4104	messenger_update.exe	144
PID 5712 wrote to memory of 3712	5712	cmd.exe	146
PID 5712 wrote to memory of 4912	5712	cmd.exe	147
PID 4912 wrote to memory of 4900	4912	messenger_update.exe	148
PID 5096 wrote to memory of 3284	5096	messenger_update.exe	152
PID 3284 wrote to memory of 4688	3284	cmd.exe	154
PID 3284 wrote to memory of 5188	3284	cmd.exe	155
PID 5188 wrote to memory of 5832	5188	messenger_update.exe	156
PID 5832 wrote to memory of 5484	5832	cmd.exe	158
PID 5832 wrote to memory of 4512	5832	cmd.exe	159
PID 4512 wrote to memory of 4348	4512	messenger_update.exe	160
PID 4348 wrote to memory of 1896	4348	cmd.exe	162
PID 4348 wrote to memory of 2496	4348	cmd.exe	163
PID 2496 wrote to memory of 3152	2496	messenger_update.exe	164
PID 3152 wrote to memory of 3540	3152	cmd.exe	166
PID 3152 wrote to memory of 5580	3152	cmd.exe	167

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5K3obdkDigOt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sBWU8pIDNDOq.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TeqOrVCaqnxH.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XX7Gf3t4v4vv.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oNJzMgq8qY7K.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KT5RDcz2ftMH.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2k4iB1ql3Yg6.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\syAAzD6Y2gpc.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M7kO78Zann26.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoshDSctPXg1.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\88CNhiRKlcmh.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ab2oOHAjc4xW.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cfqP4M3q4CRu.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U28GB4mMus7F.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsDCsflXrhH8.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HA9OUmXuWrjz.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WzEkqhNL3OYV.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x20V7ikolLp0.bat" "
        36⤵
        
        PID:4900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OMIaB5oP8tv5.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KBz7xjNIz9aN.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LHWg3dxCprGn.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l3UHF9EngpjP.bat" "
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Zgca73VsLkSx.bat" "
        46⤵
        
        PID:4380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lN2DN9mXUvYQ.bat" "
        48⤵
        
        PID:2972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aC60m7mzgKBj.bat" "
        50⤵
        
        PID:5516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LLcV2EJZU9MQ.bat" "
        52⤵
        
        PID:2080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ST3Gatp0hxJv.bat" "
        54⤵
        
        PID:1100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqYWctG1iQvM.bat" "
        56⤵
        
        PID:4044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r77HUJ2WhHKv.bat" "
        58⤵
        
        PID:5392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smrJIHeRtMnl.bat" "
        60⤵
        
        PID:2128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GVLdE73B1bkf.bat" "
        62⤵
        
        PID:5700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7UneUB3ig69Q.bat" "
        64⤵
        
        PID:2688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FemMz3QZAXB4.bat" "
        66⤵
        
        PID:5388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W3UOwehR17TN.bat" "
        68⤵
        
        PID:2640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9Mcjjfev3E7v.bat" "
        70⤵
        
        PID:5536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z21tmKeU9B9M.bat" "
        72⤵
        
        PID:4132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7mYfXmK5J5uI.bat" "
        74⤵
        
        PID:3448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hRjzXKLzI9sH.bat" "
        76⤵
        
        PID:3496
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qTUoTzMtEVOC.bat" "
        78⤵
        
        PID:5908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1VsyAwilK2Za.bat" "
        80⤵
        
        PID:740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E1OFNTOUsV2S.bat" "
        82⤵
        
        PID:4432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOuTxSxrWb62.bat" "
        84⤵
        
        PID:5984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gkXfdmBZ9TFV.bat" "
        86⤵
        
        PID:4108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8p3xCVDBoH1y.bat" "
        88⤵
        
        PID:540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zSOYlhubiXMH.bat" "
        90⤵
        
        PID:4632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DdqNgAABIWYr.bat" "
        92⤵
        
        PID:3640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yY7vsHOGWtMr.bat" "
        94⤵
        
        PID:5172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAaFdpWrZgiQ.bat" "
        96⤵
        
        PID:1388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8ORTveoZRsvy.bat" "
        98⤵
        
        PID:1856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCFSOyfxZg99.bat" "
        100⤵
        
        PID:1040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d6zWTFFr5q8s.bat" "
        102⤵
        
        PID:1404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2O8nxMRAP9iN.bat" "
        104⤵
        
        PID:4856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MqJeisIQqrJS.bat" "
        106⤵
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2akdpAfTpXtn.bat" "
        108⤵
        
        PID:5484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        109⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1EPBud3tOqK9.bat" "
        110⤵
        
        PID:908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        111⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lViNgtjc52eh.bat" "
        112⤵
        
        PID:3364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        113⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TulujvOXdtCM.bat" "
        114⤵
        
        PID:1460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        115⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gm4wRRCgNGyi.bat" "
        116⤵
        
        PID:5588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        117⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PDT7VcHqaBYp.bat" "
        118⤵
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        119⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5uORvme0gE8G.bat" "
        120⤵
        
        PID:4960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        121⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qOFVeVViL5yR.bat" "
        122⤵
        
        PID:3132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        123⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\15CwVprhWeFZ.bat" "
        124⤵
        
        PID:1640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        125⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2yhQmvI2sirS.bat" "
        126⤵
        
        PID:4788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        127⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UI6APlTfHHur.bat" "
        128⤵
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        129⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        129⤵
        
        PID:1276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4A4lqRu4m3lT.bat" "
        130⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        131⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        131⤵
        
        PID:5968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GlZY5ttqHczU.bat" "
        132⤵
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        133⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        133⤵
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0QI7OlGLjFlb.bat" "
        134⤵
        
        PID:3740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        135⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        135⤵
        
        PID:1664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gDq4Duh8ehUm.bat" "
        136⤵
        
        PID:4124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        137⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        137⤵
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5drqRmCevAuQ.bat" "
        138⤵
        
        PID:5092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        139⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        139⤵
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VjSXzQgwqb3P.bat" "
        140⤵
        
        PID:4672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        141⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        141⤵
        
        PID:3292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ODBqFFkfj1kq.bat" "
        142⤵
        
        PID:5176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        143⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        143⤵
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wwl7e2M43IfG.bat" "
        144⤵
        
        PID:2172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        145⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        145⤵
        
        PID:4336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4aA9IMzlHNOB.bat" "
        146⤵
        
        PID:2984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        147⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        147⤵
        
        PID:3704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iOolOrx110PB.bat" "
        148⤵
        
        PID:564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        149⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        149⤵
        
        PID:5180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5hiSqwGgqrEM.bat" "
        150⤵
        
        PID:1604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        151⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        151⤵
        
        PID:2488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jq8XdcEzwCFj.bat" "
        152⤵
        
        PID:1940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        153⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        153⤵
        
        PID:2852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4i83pCDBT8Tl.bat" "
        154⤵
        
        PID:6132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        155⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        155⤵
        
        PID:488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v1rGiCXrWdPh.bat" "
        156⤵
        
        PID:3504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        157⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        157⤵
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BfRGIdtgnQjw.bat" "
        158⤵
        
        PID:220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        159⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        159⤵
        
        PID:1288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8hRYtAqv76Kg.bat" "
        160⤵
        
        PID:1452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        161⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        161⤵
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\orvC3CrZWhq8.bat" "
        162⤵
        
        PID:5228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        163⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        163⤵
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J661woa0R7UA.bat" "
        164⤵
        
        PID:1356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        165⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        165⤵
        
        PID:3712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CkzouvI5i6zX.bat" "
        166⤵
        
        PID:5056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        167⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        167⤵
        
        PID:2928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqJLh9l6nbrb.bat" "
        168⤵
        
        PID:1848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        169⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        169⤵
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qZraj5ZBeuN6.bat" "
        170⤵
        
        PID:5032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        171⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        171⤵
        
        PID:2328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cHr6c2n7luno.bat" "
        172⤵
        
        PID:5168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        173⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        173⤵
        
        PID:1132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z9JKYBj2O7DF.bat" "
        174⤵
        
        PID:196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        175⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        175⤵
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RraorxuXhxop.bat" "
        176⤵
        
        PID:5716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        177⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        177⤵
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BNovt3mfPX4E.bat" "
        178⤵
        
        PID:1228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        179⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        179⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0ML5ELlzdu7n.bat" "
        180⤵
        
        PID:5940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        181⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        181⤵
        
        PID:1412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XpqUUbhrtI0K.bat" "
        182⤵
        
        PID:6096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        183⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        183⤵
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iZ5RvH6HU6qp.bat" "
        184⤵
        
        PID:484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        185⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        185⤵
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sT0MOy0YYnOc.bat" "
        186⤵
        
        PID:584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        187⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        187⤵
        
        PID:1448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jTRKLthTPqt7.bat" "
        188⤵
        
        PID:2500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        189⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        189⤵
        
        PID:1824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kJ6a6q9hGi4X.bat" "
        190⤵
        
        PID:2160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        191⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        191⤵
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3qlirT7tBD00.bat" "
        192⤵
        
        PID:5560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        193⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        193⤵
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IFdKwcozVxq9.bat" "
        194⤵
        
        PID:4916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        195⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        195⤵
        
        PID:952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8UIBrghqaBm6.bat" "
        196⤵
        
        PID:1188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        197⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        197⤵
        
        PID:5676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dFqBjtSeYn0F.bat" "
        198⤵
        
        PID:5812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        199⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        199⤵
        
        PID:6120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R6xdYXlee8C6.bat" "
        200⤵
        
        PID:3956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        201⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        201⤵
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF1G77P4uvJx.bat" "
        202⤵
        
        PID:388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        203⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        203⤵
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7QlZqeI3jpqS.bat" "
        204⤵
        
        PID:4076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        205⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        205⤵
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uXdNgnVJmqdn.bat" "
        206⤵
        
        PID:4940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        207⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        207⤵
        
        PID:6112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hHZSPJuTI9XX.bat" "
        208⤵
        
        PID:5876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        209⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        209⤵
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\STeIEiY1AfRS.bat" "
        210⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        211⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        211⤵
        
        PID:3708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DqFAyYyub7HF.bat" "
        212⤵
        
        PID:5376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        213⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        213⤵
        
        PID:5428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vmCoSKRfIC8z.bat" "
        214⤵
        
        PID:3080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        215⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        215⤵
        
        PID:1764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24d5Io9zPywr.bat" "
        216⤵
        
        PID:2480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        217⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        217⤵
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGcUAS5GNUx8.bat" "
        218⤵
        
        PID:5624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        219⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        219⤵
        
        PID:5144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tc9TgIg2lGAE.bat" "
        220⤵
        
        PID:5956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        221⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        221⤵
        
        PID:4716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qj7wB6OCBN7W.bat" "
        222⤵
        
        PID:5372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        223⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        223⤵
        
        PID:4556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3QeqpleEkyNi.bat" "
        224⤵
        
        PID:1464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        225⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        225⤵
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\193lWDJM87st.bat" "
        226⤵
        
        PID:4136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        227⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        227⤵
        
        PID:1436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dKaYAfoRwsSG.bat" "
        228⤵
        
        PID:6024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        229⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        229⤵
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0xD0AY0YRxoP.bat" "
        230⤵
        
        PID:6032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        231⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        231⤵
        
        PID:2304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tHvpCOfUqN7I.bat" "
        232⤵
        
        PID:5948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        233⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        233⤵
        
        PID:4800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKDVOIbKyexk.bat" "
        234⤵
        
        PID:3784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        235⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        235⤵
        
        PID:1908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d4Qc01TPm657.bat" "
        236⤵
        
        PID:4952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        237⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        237⤵
        
        PID:6012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ARFATU8ljayz.bat" "
        238⤵
        
        PID:5564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        239⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        239⤵
        
        PID:1540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f9kJLh5W1T5D.bat" "
        240⤵
        
        PID:4572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        241⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        241⤵
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eGRnKRyQndBy.bat" "
        242⤵
        
        PID:3268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        243⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        243⤵
        
        PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

15CwVprhWeFZ.bat

Path C:\Users\Admin\AppData\Local\Temp\15CwVprhWeFZ.bat
Size 185B
SHA256 a53c79cd8b6cfcb335b176aba2a24ffc114a8bd9356d156ba6554448ae53170a
MD5 2bca4ca37416170dd063ca791abca336
SHA1 d7dbba054073ccb2e34053092b9df4570c5ff692
SHA512 f90bfee6bd8e09c803dd3fd0352e995afa50ae859f9b769efed4ab98db98ef7cdfd083de4e3168bb6f6a5463a69258352a0fc3883ec2a22936baab372c86a5e2
TLSH
T1EFC0124141858A5E86045C0B19A977CCF0A908992D49BFA04601885D13D2C5DB9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

1EPBud3tOqK9.bat

Path C:\Users\Admin\AppData\Local\Temp\1EPBud3tOqK9.bat
Size 185B
SHA256 d3451ac071400eb34b1389e0e248513d489ef400defb5b541a76c799d2b7763e
MD5 c53610230eefdb4c3da2bc61ba7d63ef
SHA1 863990b2ca741bb8f645346b93eaf1d67e59781d
SHA512 33108a07d56d2aa2a31449c46ca0ffdd22645e2a4e07af0758f45df4020c3eeb704026c8270066229fc93079ab044bb5670f684ba206405b399cf64af6052e50
TLSH
T124C0120156818A5E45046C0B19E9668CF09508A92949BFA445018C5D13D7CADB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

1VsyAwilK2Za.bat

Path C:\Users\Admin\AppData\Local\Temp\1VsyAwilK2Za.bat
Size 185B
SHA256 508aadee410c63b45e31685e9ea90d92d31cf21103bcd3f91ccd33f54ab9edb7
MD5 5bfaffa5362ee07f95e9092c9d0a1467
SHA1 d0402e92c1b009082efbdbf7f2829c2cabf6c6c7
SHA512 81d94c5f336260cb4349177c7315f90e5a629aa01b003d3e6cbf0c9fe4343b9f683b7166a219f86b77a87c4aead2d4a7c0c20777ca5b14848e185fee7b31964b
TLSH
T1BDC0120241C1CF5E49045C1B29AB668CF0A609996D49BFA14511885C57D2C58B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

2O8nxMRAP9iN.bat

Path C:\Users\Admin\AppData\Local\Temp\2O8nxMRAP9iN.bat
Size 185B
SHA256 9b4d96ab2b89d245ac88a6db2c7eace867efb7aa7c50cd7f17cd7a502427dd03
MD5 03cfea1026b077febbb4f4f6117873c7
SHA1 651063197cf5d300f21274d222366559be507d26
SHA512 2f0c3d766e11cd8f0b511b420a68b41716ddfedb6f710d506b9748a691e8b9b63a3550da31d19d9f9fb0f424aacd30689de4ce2bd0d099386b96129507604124
TLSH
T116C0120142958A5E45045C1A19E9668CF19608996949BFE14911C85C17E3C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

2akdpAfTpXtn.bat

Path C:\Users\Admin\AppData\Local\Temp\2akdpAfTpXtn.bat
Size 185B
SHA256 c897bf12ffec3285298c52e90bd5802f59abbdced3d4b82cbc191fe38226cbe2
MD5 1f0e64b59b591a369ffcea605e0b8914
SHA1 ff64c32f493e2a1bacaf125a660c035645fe58c3
SHA512 0494bd11283c447b2516410760dbe31e66e138c2eccd6b7de1ac2cbd53da47e47d1c16fa9f97dc35ede7527af392e189054dcae76cbd51ba8031840cdd13173e
TLSH
T19CC0120151858A6E45146D1A1DEA668CF0D5089D2D497FA44941CC5C13D6C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

2k4iB1ql3Yg6.bat

Path C:\Users\Admin\AppData\Local\Temp\2k4iB1ql3Yg6.bat
Size 185B
SHA256 a0f990d7ea205e628332269274733e1042b81ce6b4b8078db583ce54eb33f027
MD5 0e01c667428a396225891029edff6931
SHA1 cedbff55a36b25b334dbf2b4dcfea7c552665832
SHA512 2981ce5aaef8cffa79cde3e75114f173873f9985f5ca8e60e303ee76a8c317d328b864c862f98dd4cb17bbe06388f4d1d4a9aba7470d9156c80e5be987886d73
TLSH
T17CC012018685CA5E46145C0A59E9668CF0D5099969497FA54901CC9C53D3D68B6CB782
MD5 SHA1 SHA512 TLSH

Submit Download

2yhQmvI2sirS.bat

Path C:\Users\Admin\AppData\Local\Temp\2yhQmvI2sirS.bat
Size 185B
SHA256 15075df16f6c237ac1573132d451bd3dc4aaf94a621f5f7aec036c0565f40f37
MD5 dc9b995122c3fd0c2dcdc9a7dacb9100
SHA1 a084916c3d13e7a7bbf91bb9b3fd4d9a0f974804
SHA512 790e500b17993957107c7cca881de559e2cb35e940a0dc5bf56cfb9f7cfc1e18755f5ca5b7aecce4f343ee259ffce9c632332149792c67982f6b3b3f70451381
TLSH
T124C0120141958A6E45045C0A19E9668CF09908A92D49BFA04511CC5E13D3C5CB9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

5K3obdkDigOt.bat

Path C:\Users\Admin\AppData\Local\Temp\5K3obdkDigOt.bat
Size 185B
SHA256 30d38a0d00bb170dd5bed52208111d22909d8d979754d414b407440123f95b0c
MD5 3345fcec3869f50a5bdf475eac801a30
SHA1 fb06e0528d49da1cbc3d11635d91810d7149bbd4
SHA512 1bfa737b9d4e5e11e86ffbb980c6ad333a2225527f4e37fadb8301721dd893b906579d49f38ffcd2dc116f65048d120e0ef65c210b92ac9e9da1b78a3dce71f4
TLSH
T1DCC0120141818A5E57045C1B5DA9A68CF09508996949BFA04911CC5C13D3C58B5DB786
MD5 SHA1 SHA512 TLSH

Submit Download

5uORvme0gE8G.bat

Path C:\Users\Admin\AppData\Local\Temp\5uORvme0gE8G.bat
Size 185B
SHA256 b1660ca6f6db7953de00b79f99d19cd6c6ec8a4f33535c6e0ea9e2451cdd0ae0
MD5 2a1e2f3f6d9732e41272378f23d2de13
SHA1 e1b51661752c204d1c2918e8dc2f0c4df1f55cea
SHA512 67d68032e4fa774133fb322719fcfe278e5145ce9bc7a19fc17e7a2e6f7ccef7b559333a88fab5424c02d4b8d90e2282909e98f1918dbe31bf8d8c83e6019eb1
TLSH
T1D5C012114591CA5E4A045C1A59A9A78CF1AA0C9929497FA04A01C85C57D2C58B9DFB82
MD5 SHA1 SHA512 TLSH

Submit Download

7UneUB3ig69Q.bat

Path C:\Users\Admin\AppData\Local\Temp\7UneUB3ig69Q.bat
Size 185B
SHA256 95c0e9bc47e624b4c36102157b251203101934f0331170e9f2a4b36112117f43
MD5 0e638551fb1224a101089af0edcba908
SHA1 cbd97f581e42b8e1386cfd5b99e071d7a08afaaf
SHA512 6559ebe6d9909aeeb6c99fbb56f7956173a1413af345f47c18f2b86aea1089b535d3bbc303a13249a38436c4a997f1e8f91c21813243993cc846d4056dd3420e
TLSH
T1D2C0120151818A6E49145C1A59A96A8CF095089D2D49BFA04941885D23D3C5CB5CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

7mYfXmK5J5uI.bat

Path C:\Users\Admin\AppData\Local\Temp\7mYfXmK5J5uI.bat
Size 185B
SHA256 3e5750d74237bb3cb185f56557e1644731e43fed351737c8706c4ee52da387d9
MD5 63022122e91a76b76c078d6d63644d03
SHA1 cc7ceb26e157c29bbf38a6f19e151e8fd62425a3
SHA512 876db5b73a4eb9d9b088aa424f7317a9c42b634a07b20970f7066edc22df6f5a77a1a4a430ea4e60f3966264a8d466d5e977ed8882525f12f304a94727743f72
TLSH
T195C0120146818B6E45245C1B59AA768CF1A508992D497FE045218C9C13D3C58B5CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

88CNhiRKlcmh.bat

Path C:\Users\Admin\AppData\Local\Temp\88CNhiRKlcmh.bat
Size 185B
SHA256 58e14dde63a04533b82db22615c829b04a9be547ab7ae8093ab06bc646cef746
MD5 5b98b16357909122f8976af6573ba528
SHA1 d442bd4e9851b067135f4eca3a7c9b2b05dbc995
SHA512 d559a92e8c86a92e18f0f1a3dfe1af0cc9c6fcce00c2b4570a1e1dadf99cefae8ba8ca90b74ca8476fe82a92d4d7f7fbfc607055a9c4a91d8fbc2ceb4df329d8
TLSH
T129C0120151818A5E4A045C0A19E9668CF0AA08996D49BFA045018C5D5BD3C5DB5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

8ORTveoZRsvy.bat

Path C:\Users\Admin\AppData\Local\Temp\8ORTveoZRsvy.bat
Size 185B
SHA256 abea16ec44232d081fd2294173910c55b7b1db4a5b75cd3067b27fc211a6a230
MD5 531777ab2cf7a7ce2a83ac2376bb8a88
SHA1 5b26250118d8306a29f8a5ad670e59628be3a9e5
SHA512 dae9c5f18df6edc59194b65689daadff8543343de3a873ed7e132e453687cfb6648457bee3b17d8d853192515c78bbb6b95089409adae5c1baf42d405dfadf21
TLSH
T1B8C0120181818A5E45145C0A19E9ABCCF0A608A96D49BFA14641885D13D6D98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

8p3xCVDBoH1y.bat

Path C:\Users\Admin\AppData\Local\Temp\8p3xCVDBoH1y.bat
Size 185B
SHA256 d3b8b70d5e3035b18d3fa67619aeeb552996da3d4ab3ee8a9273c3069ab2309b
MD5 2a6342d366255b3b0b3aad3f26e05533
SHA1 004866869010ea4d43f09858f0fd992f920bd24d
SHA512 3edba2f39e401f550623ce681ee22822672663abcac88b8b187da6b36b4d322ea9318ff99713d0f150d5bbc4624de1f236176f838f1036790b1e774cc5914489
TLSH
T111C01201D181CB5E45545C0B59E96A8CF0A5089969497FA14601885D13D6C5CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

9Mcjjfev3E7v.bat

Path C:\Users\Admin\AppData\Local\Temp\9Mcjjfev3E7v.bat
Size 185B
SHA256 81264b5e9ec6ef00f69325c1f6a7d75e04086021e5e8aa5e1be85df68e697c33
MD5 df75d9be66bb7b9ce6f6e6970b022673
SHA1 235484909a191613169a9fa5cce08ac425789793
SHA512 2365967e4d7a7632355d43fe6601a843d08d723ac79c3d1d05ed037196793c181589c6c020aaccf60156f6bc1609a940129e4db1132b2c3e59bc5c002c569a78
TLSH
T19EC022008182CA1E05001C0B08E97A8CF0A608A829487FA00600CC8D27C2C98B4CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

DdqNgAABIWYr.bat

Path C:\Users\Admin\AppData\Local\Temp\DdqNgAABIWYr.bat
Size 185B
SHA256 cc56dbb36f15ae0ada8518515daf9cdfd4375e957acb8665c3006d56650b6f84
MD5 0daa307d450fdcf9123097266a777f5b
SHA1 6ea2a0d6c0fe9f3e3a51550d555ae32e6e59ffaa
SHA512 f52e559cbfb4c9491e437909e1725f6dcca23c124fc480a8ab2b560f9638e295793935973847ba1a04d9b872ea8e81f379a066d4c483a0924a88456c56d8a3c2
TLSH
T1F6C012018585CA5E56046C4A59A9A68CF1D609AE29497FA04601C85C53D2C98B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

E1OFNTOUsV2S.bat

Path C:\Users\Admin\AppData\Local\Temp\E1OFNTOUsV2S.bat
Size 185B
SHA256 d10159d79a029781515d427d02fffc9d5d38c424e909b529403700d353c3bb25
MD5 0324559c9d5f07f6673d1999a390742e
SHA1 5ba99efd879115bf2461e41c7d8c8de942e0ca1e
SHA512 61058a8d09dcad7c7791ed24f41f67e9cc8424c4bfe8c20be259a1b90838f0027c6c5bca94e19ae55e626b05314530f5fe690ea7b1e0beb4f7e26a5fd68b625a
TLSH
T11EC0120151958A6E45185C1A19AA76CCF09509992949BFB04501885D53D6C6CB6CB782
MD5 SHA1 SHA512 TLSH

Submit Download

FemMz3QZAXB4.bat

Path C:\Users\Admin\AppData\Local\Temp\FemMz3QZAXB4.bat
Size 185B
SHA256 a512e0f0cc34f57c74edb8f7f27611842eda93a64d2024289df3e27b8897ec9a
MD5 85cd37ee7b3794b649f44ddfd2d04fcf
SHA1 040b76898d60a94edbe1abeac4e9565ab20227c0
SHA512 1cf2e35c216c7378e7570db6d67f54fa10bd861294a43256d61235d3f9b830f8ca8ff1c24ef0a34028aebb45733c3d79db8ae63744f386ce472cc6cf1201f457
TLSH
T19FC012114282CA5E46045D0A59A9668CF19609992A497FA04611C85C23E2C98F5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

GVLdE73B1bkf.bat

Path C:\Users\Admin\AppData\Local\Temp\GVLdE73B1bkf.bat
Size 185B
SHA256 32b8f286f97371ed345edc12d8ca2f7a9bfc2986e5e1a3461a3edc8fffd42237
MD5 248fd8e645f5a2d691d59e66f8261cf9
SHA1 c7963862df68d429aa3141f0ad87da49518f2b21
SHA512 1a62699fb85eaa67b7f94253b96770419fc606fdb5544c7428534766f94620b99e84c9a5f7e2a8c1407c5158239cf50ddfb9ebd3a043071b974c2c5b2c758749
TLSH
T191C0120141818A5E45045C1B19AAB7CDF09909992D4A7FA04501885C13D7C68B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Gm4wRRCgNGyi.bat

Path C:\Users\Admin\AppData\Local\Temp\Gm4wRRCgNGyi.bat
Size 185B
SHA256 581e28d037af1425342da99bc1399a67f229c2b03fa9a36d2effd2722e42ddf5
MD5 fff73939827ac85c6c1ef408f958fb7e
SHA1 3989f21ac65c9cc1a18e17203c3cf533d9f187f6
SHA512 9ed1fc49fec2e4b182e7916eb74e37e042936eba5e839f7cc9d09a5752f8611c964f6235f84d217531ed61b1fd67698239e16f4728912aa54f74c5f4987d2b60
TLSH
T1A7C0120182828A6E46045C0B59AA668CF0DA0999298ABFA14501885C53D6C59B9DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

HA9OUmXuWrjz.bat

Path C:\Users\Admin\AppData\Local\Temp\HA9OUmXuWrjz.bat
Size 185B
SHA256 999d3d62abca73a397abba305f7e81c945acb43add4f17b494e424511e5ba94e
MD5 fcde823b830755d36369c95055c13522
SHA1 4bf2786d54abb326a2ccbd206d9d3670577692ba
SHA512 3e90748ab703300816881c09c354b48ad18e128b2767a8a9021cffaa72d59b6635337fcf07c660c4bb11432c680537499755cd7cfe13809dfeac7908c9a35f5a
TLSH
T17AC012014586CA5E49045C1A19A9668CF095089D2A49BFE04901C85D23D2C78B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

IsDCsflXrhH8.bat

Path C:\Users\Admin\AppData\Local\Temp\IsDCsflXrhH8.bat
Size 185B
SHA256 e8fd192225ddc6d699c3ecf1afbab5b6b3040ef5bb9fd5d342d3137dabc07eff
MD5 6b7167aa7e21ff0e9beb8a2b479c26f1
SHA1 813d765e277e465b6512ecc289179b55509385b1
SHA512 1328af99c2a4c0a3d77505cea198be6cc366eb6c6504d7b24f176c6f1e05fe5c7295fb43ce5660a827698e3a6b9b0b1be4a19f1135f66218029b99b2793b6de4
TLSH
T134C0120192C1CA6E46045C1A19A9668CF0D909AD6949BFA04511885D13D2C58B5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

KBz7xjNIz9aN.bat

Path C:\Users\Admin\AppData\Local\Temp\KBz7xjNIz9aN.bat
Size 185B
SHA256 b7f41bc5075a4734772b9a41cc592c026e3564a813e4b4835db2ee4c2cc1b016
MD5 6dafa031a6f82608a93ad5a852689773
SHA1 55176c4fc8fa81df3bc608671026235c4c72d421
SHA512 734ba8434d80d3e98d7e38eeba9cf408b6cea8b8f26d7bd761db3cef190d068d6923fbabae386f0d1faae15df510a57cbaa4cefea627e15179b0a890e5dd04e5
TLSH
T1DAC012028281CA5E59045C0B5DA9B78CF0D7089D6E497FA44611885C17D2C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

KT5RDcz2ftMH.bat

Path C:\Users\Admin\AppData\Local\Temp\KT5RDcz2ftMH.bat
Size 185B
SHA256 d90dcb35fa4e930984d51b1af83d5331f568698f3b1d5c4670de472bfb1c2310
MD5 0acd95e767e1b61451a6e3de4bb0fcc8
SHA1 d4680222fad30e07a631c60cbf2d7a2e454acc25
SHA512 c49655958d916fd113ccda9908e9b800064bc401396c943ad449b240d5f7c884ecf2f8a1f9d2a59d03f747c65cf156975ff1f9d2510fa3bbb8e249107ab72302
TLSH
T14CC0120142818A5E4A045C0A1DEA768CF0A609992949BFA04501885C53D7C5DB5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

LHWg3dxCprGn.bat

Path C:\Users\Admin\AppData\Local\Temp\LHWg3dxCprGn.bat
Size 185B
SHA256 d3c939dda969c0c746c31204ca0119c7a578ec5ad148e4f89badc491789dac60
MD5 e617b027d663bd24808140678b87e9b7
SHA1 68add5ffb18c8a7f8fac2dc43bab57d7be063d0f
SHA512 f85298e7ed28f2170d2a943fe918f2d757c9521f4951e7085b396961d2a5eb909e1dc0545eab279548e2016217d0e0d5822e422b707b8b20725aa65c613b3fbb
TLSH
T1A6C012024181CA6E45045C0A19AAA6CCF0D908A969897FA449518C9C13D7C5DB9CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

LLcV2EJZU9MQ.bat

Path C:\Users\Admin\AppData\Local\Temp\LLcV2EJZU9MQ.bat
Size 185B
SHA256 c4c77f9daddcf0dc317fc93408e49e23bf2ec58d67459bfbfcdff6780fadc177
MD5 aa9c0b882217fb3971a94aeee9eaa402
SHA1 c5f761317417b3db54b2a0a9de9bdf60d7bf22e5
SHA512 bd9f2c3a572fbc3c439fbfb199ffe7aa7731edd01a3e838f213a4825ab6f468a55fd9a8347f38a96267fb124f1b40821706b61080a89a443c03fb9d88f8c71be
TLSH
T1E0C0120141818F5F59145C1B59A966CCF09508AD2949BFA04A01C85D17D6C69B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

LoshDSctPXg1.bat

Path C:\Users\Admin\AppData\Local\Temp\LoshDSctPXg1.bat
Size 185B
SHA256 df426b74a217938607d77999245b792c304f93072ea3f838fb825e924efeb0d0
MD5 16a477ee083e31042e28c955f6fbb773
SHA1 250338fb3339ba16021527c276569e83fc93aca9
SHA512 80d873a0897c737c613e1a55b13e48be80fdb0232ac6dbba3e76e833d2849097cf397f84d4fdd71e2a28b4e3eb16af2df60474c2c92e458aec19e9a11e3ce6e8
TLSH
T154C0120241C5CA5F45045C0A5DA9B68CF1A50CD929497FA04A41885C57D3C59B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

M7kO78Zann26.bat

Path C:\Users\Admin\AppData\Local\Temp\M7kO78Zann26.bat
Size 185B
SHA256 5de312cbf2fd36e0cf37cd85399e5cb3df9de95ff0f4974b002be5d4125154df
MD5 7c38d4dee98b92fd84a938cfd27211fa
SHA1 dc62dfa2a8e2b0d270ae6af25dac58bc8c48c7f5
SHA512 5666bea937c54b279087aae7e189fdfc8d24e49100c9c3ff17b07f32cb7622cf3284a136d4029d14b65529c38c1f6a0d077b6e8c7560845e96b4e93af65007ce
TLSH
T1EBC022004181CB2E05041C0B18AA668CF095089829897FA00501CC4C13C2C58B8CF382
MD5 SHA1 SHA512 TLSH

Submit Download

MqJeisIQqrJS.bat

Path C:\Users\Admin\AppData\Local\Temp\MqJeisIQqrJS.bat
Size 185B
SHA256 224855fc31f43c3fe8cbafcd584f9aa06a7c102f7fa0d43d23ea062ed2289629
MD5 b27ef7ab3b227e93a12dd2cae5b0510e
SHA1 5f04527454529bed8469791e4a2a4b66b0608ebb
SHA512 afc39a550d60a6fd2b5479238291fd9c1f5083156f37afaeec82b368f70580782906024535b9eb6caa44e57aebbf45713d45ec08a1634bc7ac24dbef88da0d44
TLSH
T1B8C0120145918A9E49045C0A19EA67CCF09A08993D49BFE44911C89D53D6C6CB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

OMIaB5oP8tv5.bat

Path C:\Users\Admin\AppData\Local\Temp\OMIaB5oP8tv5.bat
Size 185B
SHA256 5ff30fae4c62742eeaf6b8afa2fcca5c50e877e989c3da5c06d1ddfa57942795
MD5 84d20c41fad500e6f42d35c04104fb74
SHA1 e1f7e34e5880795adb6041f3b4c44260ffb399f9
SHA512 7b8aed061b3cac56696050c93be6c5b17318bf7afa4f42a4051feb395eef90c9ed1ab8f2087d0dc7bad717919496e9b036599fe2607276658baa9c743b22f735
TLSH
T1D5C0120181918A6E59045C0A19E976CCF1A5089D2D497FA045018C9D13D3C99B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

PDT7VcHqaBYp.bat

Path C:\Users\Admin\AppData\Local\Temp\PDT7VcHqaBYp.bat
Size 185B
SHA256 a406ad3b592eb617808bcf98ed7eba787dc53b58bd5d33fefba82639967bbb7d
MD5 61b6b934c237c3695d8e395b6a0c869c
SHA1 be1da9355b95cf7eb1b20096fa64510086d7fbf6
SHA512 48ffa9c1654e49e3eb2a68ab7f07f2be7d03d663c4a86d64485e3db546988974837827eac3a555781dd149b3e600307ff201b52b40120197b9f38dd96d27140b
TLSH
T10FC012018581CB5E45145C0B19B9678DF0DA08992D49BFA546418CAC13D2C68B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

ST3Gatp0hxJv.bat

Path C:\Users\Admin\AppData\Local\Temp\ST3Gatp0hxJv.bat
Size 185B
SHA256 01f9857002e09abe8b644c85d14a2b25e809b5ff62f505e36c4957151fd24d47
MD5 4cb8b6f63644bb6bd812184005d615e5
SHA1 52a0624f257755ee1c22ebf356e3abdda360f345
SHA512 5480e8fc63e3c9582d62e71dfbc451baa068219fac257d75726f6d660452a06f295c3fa41224e88e9b2f19ab33b93cf43ed2788ecc4a100034f7816d24fb2704
TLSH
T100C0120141818A5F45085C0A1DA9B78CF09A08D92A497FA04A018C5C23D2C5DB5CB7A2
MD5 SHA1 SHA512 TLSH

Submit Download

TeqOrVCaqnxH.bat

Path C:\Users\Admin\AppData\Local\Temp\TeqOrVCaqnxH.bat
Size 185B
SHA256 0f17eaa41d5bf3ce1b09faa7199d77f30b5887e19c0058f5eb3dff021beb05de
MD5 238bebb76815e6544b256eac38cec2b6
SHA1 0c4835f621b836efbb416b2011720d4b414f9ea6
SHA512 23c1c40558d8a659be021a2cff9c35a14bfd732090317a5cf018a6205e0db4d53ea4c586303eaecbb61c783da1aea709eafd8c9117ed29eebe242a44dc04e463
TLSH
T123C0121142858A6E46145C0A59A9678CF1D908AD2D497FA08901885D17D3C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

TqYWctG1iQvM.bat

Path C:\Users\Admin\AppData\Local\Temp\TqYWctG1iQvM.bat
Size 185B
SHA256 c0c97ad6655998d677aec4594c8e94b2a064adc5b96c5ad932ef9599558adaaa
MD5 850354a628ba359ef20ab19ecadcb15c
SHA1 d749d705f91d75c2e36914efb7e6d083a053d488
SHA512 e30bc85229653dc6d42fe89ea394e7a8a6f424bb16e967f0df190563bb2b7ba5c2dd6e34885afa75f9f2c30b582d44b8b5f32a63261e7c65adf2840df5cbc949
TLSH
T172C0120142828A6E45145C0E19AA668CF0E9089D2949BFA44A11CC5D23D6D98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

TulujvOXdtCM.bat

Path C:\Users\Admin\AppData\Local\Temp\TulujvOXdtCM.bat
Size 185B
SHA256 d294bd4ee9e2314421bffc6e753f71ced4a9842ce93e7746e781bb1b9ec6c742
MD5 82029cd4d97047c8f6f01c06c8ae5dee
SHA1 a518772864194ef507da5287838aee07485baa5e
SHA512 cea8f88ca070a23eaf037c78ed2cb711b811a87dccae93ecb1086a1d24765994cd70f359045f7b64b3569dd131061223564daffb20c20885beeb506d0dc77e1e
TLSH
T10AC0120141958A5E45045C0A29E966CCF1D908992D497FE04911C89C17D2C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

U28GB4mMus7F.bat

Path C:\Users\Admin\AppData\Local\Temp\U28GB4mMus7F.bat
Size 185B
SHA256 d013ca40bafa65d2ee65039b3f8977111fdff225f3ee085c709b16504080fac5
MD5 53e820c08f95ab6a60f06f9f08b7531b
SHA1 a6510eba56f24a0bffc5399ea7e2474d00c29ace
SHA512 bd00d658e7a6039d3cbae028d15b9cb7e4dd2ceaacef20e014b2f1007dcc3b85eabdf56f4207f524b2986ca4c999ff61c19df33745e38242e808365cb4352e39
TLSH
T112C0120185818AAE96185C0A59A9E78CF099099D29497FA44501CC5C13D2C58F9DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

UI6APlTfHHur.bat

Path C:\Users\Admin\AppData\Local\Temp\UI6APlTfHHur.bat
Size 185B
SHA256 e458822257fbf305ec9fb96e1df8503d10575a9d4f013c1922534eaafd41d852
MD5 dd88086eb87513bf73942d66f5ccaee1
SHA1 6a0ee2c8d970ba2fa00c158e6d9240809fa26ce7
SHA512 87c3fe38781434b278df4d3264f1ccc006a014f7d1b9f8fb6456bee26be777f3e72755ad35bf94ec439fd3f66106f56f05b3ab6b9bae8bc5f652039da0d5a01a
TLSH
T1AEC0120142C1CA6E56445C0B19AA678CF19508992949BFE44601885C57D2C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

W3UOwehR17TN.bat

Path C:\Users\Admin\AppData\Local\Temp\W3UOwehR17TN.bat
Size 185B
SHA256 4fde19a6c0a191d333238081d2c1ad3f81bc9e4c760da89b613536129f5d65a3
MD5 760fde8bf6a6bbcdb8975f4e59c886be
SHA1 0140f4637ba958bfd8b81e53cf31f2a0d24c24aa
SHA512 e1c8457adeed110c614309558561484db6387125095e8d1dae0c9f5e720e396ea7371b07af5a14a8fcd8c27909b8a645b76a643c63ddbce210f6210c48e596ab
TLSH
T187C0120186818A5E5A085C0A19EAB68CF0A508996D49BFA54911885C13D6C6CB9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

WOuTxSxrWb62.bat

Path C:\Users\Admin\AppData\Local\Temp\WOuTxSxrWb62.bat
Size 185B
SHA256 e4d5da85909f5c01862b0228a9c50ed792cf8b24b13742057aa1b32dcfe03826
MD5 ba59a8f4d4128e830412a0388b051ce3
SHA1 78eb1fe5949cd2fb6be4d33d777b82781d46cba5
SHA512 90e032da761f9d279d4ae6928aacc8bcaac44ca2c8a1d4a38e961ecd784051cef98d675cfa5733f4b3c86dc1f540b6fac9e5589408968e297f276ef2693c9f93
TLSH
T1BEC0120141818A5E59045C1B19A977CCF0A9099929497FA14511C85C13E3C5CB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

WzEkqhNL3OYV.bat

Path C:\Users\Admin\AppData\Local\Temp\WzEkqhNL3OYV.bat
Size 185B
SHA256 2e5d7c2ac8eca8f1119d5b330d3972e6a922e94457d35bc88d10c01953bdf6fa
MD5 3ff12fe89d5a60cd845c716ef49c31e1
SHA1 268020f796877d653eb49bb32e59e10ac3e6c85c
SHA512 bc7fb13a0b8e7b82194e104039aaf52f6c96715e7817084cca1e9e435ddd4ae64426bfca7a19826862863489204f8c5d0e6aa4a31f619efa63a6548573970cfe
TLSH
T1B9C0120195918A5E59045C0A29A9A68CF1A5099929497FA145418C6D13E3C68B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

XX7Gf3t4v4vv.bat

Path C:\Users\Admin\AppData\Local\Temp\XX7Gf3t4v4vv.bat
Size 185B
SHA256 e4dae95d073f36e4dc1216858b3dcddce3ad6fb2563740ece2fe40576952651f
MD5 925825bdd0ae56f262a964d88e35e27f
SHA1 1a365998d03e9b29d5216b9a50f74d5746589b53
SHA512 e3f4085ec74b128fcf2983d7dccc35edaa69acc4cc83f1617070126c20e0adb9e4cde551c8aa7c5aae8835a60216e3c05df9cdbd1fbe69d4ecb0f431d8698f76
TLSH
T169C012015282CA5E49045C1A29A9A68CF0A509992E497FA445018C5C63D3C59B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Z21tmKeU9B9M.bat

Path C:\Users\Admin\AppData\Local\Temp\Z21tmKeU9B9M.bat
Size 185B
SHA256 7a8ab2158ffe51fd26edbdd6ce290d77f5046e6c6fca8c414f777a1aaba135fe
MD5 905abff0b6a705c9ef28783a2f9312fa
SHA1 73510424a6ac6caba498451ea518d242c8291a3a
SHA512 6440bb858ad62fb09a8bb05a604147b55f712b99f41d16d0ff558aaca532010212bcb94be5e20a4cff26cdc1539dfacb1c38effcdcddff388c9cde5a085712d3
TLSH
T103C0120282818A6E45045C0A19EAA68CF0D508A9694D7FA04541889D17D6C58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

Zgca73VsLkSx.bat

Path C:\Users\Admin\AppData\Local\Temp\Zgca73VsLkSx.bat
Size 185B
SHA256 9563c242353fce13392683d555959eebdb65c6fc0f3790a571a553edd77c58b8
MD5 b6302cdb70aa28c68bd444bb78ffbc45
SHA1 7924aa35c616a2828ce26ccc3092b584171c8117
SHA512 5eec151588958958e6cfaa5d9b157e22e9498c0df57f23463415664637b21e244c59a2bc4f007f61fdc94f0442cbcbeacce6a441fd6109671c90393df8984e75
TLSH
T123C0120191828A5E45145C0B19EAA7CCF0A60CA9294DBFA14512C86C53D2C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

aC60m7mzgKBj.bat

Path C:\Users\Admin\AppData\Local\Temp\aC60m7mzgKBj.bat
Size 185B
SHA256 8795fcc20cb4ba79bed51b5b2ea4e5e3eeb2c39fb156114cb2dbff55472d0e45
MD5 7c2e8c0b816c76b6a1f2e4bbcfd89ddb
SHA1 8126947c772f8c405c964f4311f7c939a03a2227
SHA512 f99f347e0c240e58c159fd4740f3807fbdc4787998d4e7d251dc174ebe44fef89f199c89f4a6e778c3a5cab3411944f1cd95162d4d8e1fe5b5326d5d4bb40601
TLSH
T1FCC0120146818A5E47145C0B59AA668CF19508A96A497FA84541885C63D7C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ab2oOHAjc4xW.bat

Path C:\Users\Admin\AppData\Local\Temp\ab2oOHAjc4xW.bat
Size 185B
SHA256 8b1723d325d94329d3336bef8455bb0dc277aafaf29348a077d68a4ec3464d94
MD5 e12196e71ed799f35826cdea1478ed64
SHA1 12939ba0427ad5b6660053d66b4e9f7670626dea
SHA512 e59b8485ad25bf3d161ef13aa41a19cafc80e5cdfa74b6e186d51f48fe66b842041b0220a08f5f0b189d55c0af9eaab345844fbd593e72850e821422c3eb44c1
TLSH
T135C0120145858B5E49145C4A5DE976CCF1A508993D897FA54901885C13D2C68B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

cfqP4M3q4CRu.bat

Path C:\Users\Admin\AppData\Local\Temp\cfqP4M3q4CRu.bat
Size 185B
SHA256 c0c0aea0eb540ca1d466358d29403c2a91c957803b84e4ff98fb6af4dd5f5588
MD5 6127b8d1539a771ea346a2d744af00c2
SHA1 03f71e46fafdb315b8430251ad1b5116af561ad9
SHA512 f9f20c9ecd138041fce8fcc75c9b348c5feb2e8d1eaf30c5ce762901115d2c60155c1a65a20676d11d6fefed235cff307dcad8ca1e1b18c2a138cec970a17282
TLSH
T11FC0120145868A6E45059C0A19E9668CF19508A92A897FA04A41C85C53D7C5CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

d6zWTFFr5q8s.bat

Path C:\Users\Admin\AppData\Local\Temp\d6zWTFFr5q8s.bat
Size 185B
SHA256 fcec148a943f5e9b632f03f86f47f45854e17e61ca0e813140534e2c106bc716
MD5 8f9bff361a0a3b645a93565aafcf57fe
SHA1 afc8bea7b3094a2c59f9f75c80efa1849c495524
SHA512 ef9f7901f59f6e9f0b00a264d68cb6fd2aeeba86c7e5ce37aface3645b8220e9b973f99250ee218e115f82cf10385d2af7af11f0dcdc7c8a9a4f6bdbcede6041
TLSH
T16BC0220081818B1E05000C1A09A9B2CCF09508982908BFA005008C8C57D2C98B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

gkXfdmBZ9TFV.bat

Path C:\Users\Admin\AppData\Local\Temp\gkXfdmBZ9TFV.bat
Size 185B
SHA256 f95a28d11ba5c37465d8b0bc29d0a2b59fe91f437d28f8da462925ec1e50ff72
MD5 82fe50e9d078be5c48de37ef69738a78
SHA1 bdc1dcbd975f1ddd237e63bcb9f08b08f3dd0af7
SHA512 75d78cbcd069ce057125aa3afcf5f6d5104b1076c1bf4d7c73d264a4313a93809cecf442da7f9e03e5064dd15763e9422235f8d05e9d3d0f48e2e9ec335ec9a6
TLSH
T112C0120141858A5E45085C0A59A9678CF0D9089D2D497FA04501CC6D13D2D6CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

hRjzXKLzI9sH.bat

Path C:\Users\Admin\AppData\Local\Temp\hRjzXKLzI9sH.bat
Size 185B
SHA256 461795786989d68c4312a461522120af9882d7891461453b29fda208d8d8fda5
MD5 ffafddd29f867cb7fe1393c8808c207a
SHA1 843c0fdaeeb98e3131107a1ae3d42d2af96718ea
SHA512 a9523716a91b41c2c96dfd26e6da083a9b6fcc9346ccc8ddd2742806b0ee000b2a12e2aba2eb6f7ddebd37ba21a240380707461e04a91062f9d5a46e04891bfa
TLSH
T1A6C0220041828A9E06001C0A0CA9A28CF09508AC29087FA145018C8D13D2C68B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

l3UHF9EngpjP.bat

Path C:\Users\Admin\AppData\Local\Temp\l3UHF9EngpjP.bat
Size 185B
SHA256 dfed8cba56a9cb2f307d1d3023d3522a0c654f5faf2d38f5bf06377974273727
MD5 dca4159ad52d5660ba4809e00cf54f76
SHA1 61d08024b691a38a943cded73dcf508786ddcb66
SHA512 04ae50fea00ff5ad655e90d1d416f9132e8a50bde87493f05837c626a50551f1eba5623a1dcf0d21da7ae74bddaf3dc9f2adb80bc6639f9c1e42c1f857af60b1
TLSH
T11CC0120146828A5E45045C0B59AAA68CF1E50C992949BFA14911885D27D2C58F5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

lAaFdpWrZgiQ.bat

Path C:\Users\Admin\AppData\Local\Temp\lAaFdpWrZgiQ.bat
Size 185B
SHA256 57a25e088f1bf166bc474e4d8023c5b5f8025cba0adc7f096a2169a3e0797ead
MD5 4ea53edee3329c9a5c64253680bb4b6d
SHA1 b31642e4c03ae04081fbb4e1fb8186bda402a497
SHA512 df2ac27eb867cd387f2a5e1f6a000a4892ad245675c223a3cbb68b2d4a7c0021a091709f2dad2e63cb5ea8fe3f7268d88a904e055bec8bbcb2c10021ad81f92c
TLSH
T13EC0120146818A5E46145C0A69A9668CF19A089D6949BFA04501C85D17D2C59B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

lN2DN9mXUvYQ.bat

Path C:\Users\Admin\AppData\Local\Temp\lN2DN9mXUvYQ.bat
Size 185B
SHA256 fabcf0754a9858767362a395347a2462fd9fa05d223a7c4137495a0dcfc1a4e2
MD5 743ca8c64be63089b7ff11c9c9b5d494
SHA1 c729bdd52dcbf965a8509ebabd7e05e916ebda74
SHA512 383a885ac5340235cd7fe7c9c4acd31780f37d170873e8d47faa4de1140491f811df3958d0be249c20bed9eeafa0769330016173c8af087249eae9b7a51c0582
TLSH
T12AC012018582CA5F49146C0B19E96B8DF099089D6949BFA04541885D13D2C99B5DB783
MD5 SHA1 SHA512 TLSH

Submit Download

lViNgtjc52eh.bat

Path C:\Users\Admin\AppData\Local\Temp\lViNgtjc52eh.bat
Size 185B
SHA256 87c1dfad676e2fb0a4013ced93e64a732510b358d7f41f1108c455044f868fe0
MD5 32fa3601bbc242e421edb851a40a405d
SHA1 d116a6d79c07b4994d9d0ea8cec10b85c26b18d1
SHA512 bd5957e84cc96dc878c46514b3838632045ef2f94f3f740d3d4e1e30704190af228f8c9bef93da7347d445a1ffed32ed9ee5e5d3988dc633fae9d2f212446aaf
TLSH
T16AC0120145858A5F49045C0A19AE678DF1A509A96D497FA04A01889C13D3C5CB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

oNJzMgq8qY7K.bat

Path C:\Users\Admin\AppData\Local\Temp\oNJzMgq8qY7K.bat
Size 185B
SHA256 0abf65c0c549a1a37eb6cda11be1777ca51318f67780b249868001abd167b878
MD5 fc7196a3a1b29e1cc308c3aa9ca8bccf
SHA1 dc99b7e1db67e622eb51f17ae5e34a09fe628df5
SHA512 21aa3587348cd12d764f9d26a12076548ecaf0d517295d411f6c4f4ba4aa11645bb94cf7ca94d297228c9be3a3270aa9fa6477e8db5639a84086df6c8d0295f1
TLSH
T15DC012018292CA5E59045C0A59A977CCF1D50DA929497FA54901C85D13D2D59B6CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

qOFVeVViL5yR.bat

Path C:\Users\Admin\AppData\Local\Temp\qOFVeVViL5yR.bat
Size 185B
SHA256 6414c952de02ca308e951a425a0b0764422480049871fda5dacdf631bd9bb0ba
MD5 244116e3522712eb070db07249ab7462
SHA1 df20b6d5ef53f2fe738f26bd8491ce0792253ede
SHA512 406ba3c2e632ae9182f27b5e33c0f2c43dfd491f1a796dc930d4a84ba7a8a5a659f64a3ce4371f368ca548917f327a06db064e874c5def6b8cf887a6ca8f9006
TLSH
T189C012014281CA5E5A045C1F19E9668CF096099929497FA44502C89D13D6C58B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

qTUoTzMtEVOC.bat

Path C:\Users\Admin\AppData\Local\Temp\qTUoTzMtEVOC.bat
Size 185B
SHA256 d6fedb27e1071510b8cdde02787c57a05f05006dd0f87ece0d8c837d923cd604
MD5 71429dcb9a13e5fea1db5d07883fbb35
SHA1 f8e324f2e61026e72588778b868653959378ec79
SHA512 163c3523940e3328c11ecd8dd9d21f56e2620c8dc5326c5624654b2d856350c46b2f81aeace4548aaf2e219ee82884fd4d9521a1183a0ad0d9ac084a1c488c04
TLSH
T171C012014581CA6E45045C0A19ADA68CF0D508992949BFA04A518C5C13D2C5CB5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

r77HUJ2WhHKv.bat

Path C:\Users\Admin\AppData\Local\Temp\r77HUJ2WhHKv.bat
Size 185B
SHA256 ca731be69b1f039527cdeec2dd17186466b11868089ecb07900ed321ee160234
MD5 155a8285475cc8b16ff2b60772b99790
SHA1 6cc595ee97e33ab58d085416ffd47f7eb336b2bb
SHA512 40b8a5c0eb4a00cc766f24de4f60e504678d748f2d4ffecdf9860d02c2596052442a36d788355ffded7794839577af3143e418c3d099d8f1ccbfb50e0bccc3d1
TLSH
T1CFC0120156818A5E45045C1B19A966CCF19508992A497FA149018C5D67D2C59B9CF786
MD5 SHA1 SHA512 TLSH

Submit Download

sBWU8pIDNDOq.bat

Path C:\Users\Admin\AppData\Local\Temp\sBWU8pIDNDOq.bat
Size 185B
SHA256 207ac71ceec253bfc17376213e4f01858b1bf4d1fed0ac54db966d271ed96c7d
MD5 0e085fa4b9d2568f5b4a9202e33b7b61
SHA1 0248c0f321788234773b25dbe230cacabd4429c0
SHA512 e7067f60c8ad48ec8705b7db73e543cadc79bb17482ef557bf690fd95ba3c6b75b18ade8883bbe5f9e6f173f4cf5de23d579d82158b943074c07f3cb778db81d
TLSH
T103C0120152828A5E46145C1A1DAA768CF09508DD2D497FA049918C9C13D2C99B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

smrJIHeRtMnl.bat

Path C:\Users\Admin\AppData\Local\Temp\smrJIHeRtMnl.bat
Size 185B
SHA256 0e2b177f34fb57f5061a9730c3667c2ca8f59fec1306187d85d665b46377d6f9
MD5 8a73aa18c3a7dde3c459e0c40939e867
SHA1 77536a061d6e42ee71913ad03930f8bf18ab99ed
SHA512 0634da3a814d8bfdfa284b2c582d19e40a2c600c20270739831950efd746ea57da9dd4025fe86204c847e5b8c75fa358202c00d911f5b0d31fe5493b234211ef
TLSH
T16DC0120145958A5E45045C1B19AD768CF1A908A9294A7FA04651889C13D6C78F5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

syAAzD6Y2gpc.bat

Path C:\Users\Admin\AppData\Local\Temp\syAAzD6Y2gpc.bat
Size 185B
SHA256 bcf8a30ee3c8262c15f4e947eb73d44a0cef2bf1f5fa83d387116939cee03162
MD5 342cf529d4665d2955d57ce1508d81fe
SHA1 09ef8e29617bccd20dc57531760059c43a9977ee
SHA512 a289dac228380a6b1058e4b13b26a087171f8f63b4a3ee3f262608ddcc8550a6bdadc911756e1ef6e55996e752e7a87cbcdd264b95f23e77b5cb88406fc67284
TLSH
T190C012014285CA5E4D045C1A59A9678CF0A50999294ABFA04501C85C53D6C98B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

tCFSOyfxZg99.bat

Path C:\Users\Admin\AppData\Local\Temp\tCFSOyfxZg99.bat
Size 185B
SHA256 071142d9bdf20547a9537147fddf670525d04d99477f0aa41f4e477cd4493024
MD5 9b86a171d2399381431a271ac52c5d77
SHA1 563476315eab80f9a681c3c307d91a31c1011cfa
SHA512 92a90f7692e2ba0ad5dcf0e3878083be89e3d9c4e67a92ac9364f82b31fa947dbe4aae3ca5a57b15941b14c9973d260091be3b41bc68725a03c68a56bdc510b4
TLSH
T13CC012015181CA5E4A145C1A19A9668CF19508992F4D7FA44641885C17D2C6DB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

yY7vsHOGWtMr.bat

Path C:\Users\Admin\AppData\Local\Temp\yY7vsHOGWtMr.bat
Size 185B
SHA256 7076de62ee9fa3aef37472d5cb8d3e07bad4cf784ce922d7ba2b2974c4c2c6ee
MD5 86f3431be6d27995293e26753f5ee6ff
SHA1 e431646c0d2c0e0ca88ff5bab27b6780fcca4323
SHA512 98ff05fefd9072b1fda2ec43a0131a27449b58a5fcdaef5ddfcf52b15ccd168752f4bbc66148a7da59281c50905203334d4dcb79b5276e79f76c14624da8eb57
TLSH
T186C012018281CA5E45149C4B19E9A68CF1D508A92949BFA04611885C13D2C59B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

zSOYlhubiXMH.bat

Path C:\Users\Admin\AppData\Local\Temp\zSOYlhubiXMH.bat
Size 185B
SHA256 479ff44651e73f13a8f49c44ebce5923df11daba1a7e12e2927c67e00a545c7a
MD5 9a6b5e45ca19f090879af20605300d12
SHA1 4c160bb2361854c489fdc3c5c3e7ec15990bd2ee
SHA512 396f08c49d4c5170745f35f715e3830a8146ebf989ab724db93da9b2cd455b677a0b62e8f711612fab2564d6a95445171827da2e822048a5d24d61702073b043
TLSH
T129C0220041818A1E09044C0B08A9668CF09608982D08BFA04900888C13C3C58B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-45-0x000000001B8F0000-0x000000001B9C6000-memory.dmp

Download

memory/464-44-0x00000000025E0000-0x00000000025F2000-memory.dmp

Download

memory/464-43-0x00000000025B0000-0x00000000025BC000-memory.dmp

Download

memory/1096-73-0x000000001BDB0000-0x000000001BE86000-memory.dmp

Download

memory/1096-72-0x0000000001070000-0x0000000001082000-memory.dmp

Download

memory/1096-71-0x0000000001040000-0x000000000104C000-memory.dmp

Download

memory/1204-52-0x000000001BF50000-0x000000001C026000-memory.dmp

Download

memory/1204-50-0x00000000014A0000-0x00000000014AC000-memory.dmp

Download

memory/1204-51-0x0000000002CD0000-0x0000000002CE2000-memory.dmp

Download

memory/2232-106-0x0000000002D40000-0x0000000002D4C000-memory.dmp

Download

memory/2232-108-0x000000001C050000-0x000000001C126000-memory.dmp

Download

memory/2232-107-0x0000000002D50000-0x0000000002D62000-memory.dmp

Download

memory/2460-66-0x000000001B800000-0x000000001B8D6000-memory.dmp

Download

memory/2460-65-0x0000000000CE0000-0x0000000000CF2000-memory.dmp

Download

memory/2460-64-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Download

memory/2496-154-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Download

memory/2556-24-0x000000001BA90000-0x000000001BB66000-memory.dmp

Download

memory/2556-22-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

Download

memory/2556-23-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Download

memory/2704-29-0x00000000012E0000-0x00000000012EC000-memory.dmp

Download

memory/2704-31-0x000000001BF10000-0x000000001BFE6000-memory.dmp

Download

memory/2704-30-0x00000000012F0000-0x0000000001302000-memory.dmp

Download

memory/3196-0-0x00000000008B0000-0x0000000000BDC000-memory.dmp

Download

memory/3196-1-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Download

memory/3196-6-0x0000000002CB0000-0x0000000002CBC000-memory.dmp

Download

memory/3196-7-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

Download

memory/3196-8-0x000000001C150000-0x000000001C226000-memory.dmp

Download

memory/3580-58-0x0000000000EC0000-0x0000000000ED2000-memory.dmp

Download

memory/3580-59-0x000000001BD00000-0x000000001BDD6000-memory.dmp

Download

memory/3580-57-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

Download

memory/4092-101-0x000000001C6E0000-0x000000001C7B6000-memory.dmp

Download

memory/4092-99-0x0000000003280000-0x000000000328C000-memory.dmp

Download

memory/4092-100-0x0000000003290000-0x00000000032A2000-memory.dmp

Download

memory/4104-122-0x000000001B9C0000-0x000000001BA96000-memory.dmp

Download

memory/4104-121-0x00000000024A0000-0x00000000024B2000-memory.dmp

Download

memory/4104-120-0x0000000002490000-0x000000000249C000-memory.dmp

Download

memory/4356-16-0x00000000032D0000-0x00000000032E2000-memory.dmp

Download

memory/4356-17-0x000000001BE10000-0x000000001BEE6000-memory.dmp

Download

memory/4356-15-0x00000000031B0000-0x00000000031BC000-memory.dmp

Download

memory/4356-11-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4512-148-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Download

memory/4512-147-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

Download

memory/4512-149-0x000000001B9F0000-0x000000001BAC6000-memory.dmp

Download

memory/4912-129-0x000000001C380000-0x000000001C456000-memory.dmp

Download

memory/4912-127-0x0000000001700000-0x000000000170C000-memory.dmp

Download

memory/4912-128-0x0000000001740000-0x0000000001752000-memory.dmp

Download

memory/5096-135-0x000000001BC30000-0x000000001BD06000-memory.dmp

Download

memory/5096-134-0x0000000001880000-0x0000000001892000-memory.dmp

Download

memory/5096-133-0x0000000001870000-0x000000000187C000-memory.dmp

Download

memory/5188-142-0x000000001C530000-0x000000001C606000-memory.dmp

Download

memory/5188-140-0x0000000001860000-0x000000000186C000-memory.dmp

Download

memory/5188-141-0x0000000001870000-0x0000000001882000-memory.dmp

Download

memory/5280-38-0x000000001C6B0000-0x000000001C786000-memory.dmp

Download

memory/5280-37-0x00000000019F0000-0x0000000001A02000-memory.dmp

Download

memory/5280-36-0x00000000019C0000-0x00000000019CC000-memory.dmp

Download

memory/5556-115-0x000000001C9D0000-0x000000001CAA6000-memory.dmp

Download

memory/5556-114-0x00000000032C0000-0x00000000032D2000-memory.dmp

Download

memory/5556-113-0x0000000001B00000-0x0000000001B0C000-memory.dmp

Download

memory/5596-79-0x0000000003030000-0x0000000003042000-memory.dmp

Download

memory/5596-80-0x000000001C580000-0x000000001C656000-memory.dmp

Download

memory/5596-78-0x0000000001630000-0x000000000163C000-memory.dmp

Download

memory/5708-92-0x00000000014E0000-0x00000000014EC000-memory.dmp

Download

memory/5708-94-0x000000001C100000-0x000000001C1D6000-memory.dmp

Download

memory/5708-93-0x0000000002DB0000-0x0000000002DC2000-memory.dmp

Download

memory/5784-86-0x0000000000B10000-0x0000000000B22000-memory.dmp

Download

memory/5784-85-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Download

memory/5784-87-0x000000001B0B0000-0x000000001B186000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads