quasar | e16a7e63b71ac839492e9b33ae76095c1b3a5bc22ff1758d7aa4edb280bb9656

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260408-dgrppafz9q
SHA256 e16a7e63b71ac839492e9b33ae76095c1b3a5bc22ff1758d7aa4edb280bb9656
MD5 65d08849d4eec2fe8af68fd47c32485d
SHA1 51201f9a9596d4252b7c7c245ebaaa5891f44053
SHA512 6cbce78bf09e066f51b054f4b6ffdc6781d01780675a2e0a66afa934251aa5156505d15baed916dee71d1c500624c22849e29da83e2f98b663350cd1a372f258
SSDEEP 49152:WyhJJHPNCC7J98vBgJh99oG4znXxixUuxGHTHHB72eh2NT:WyhrHPh7J98vGJh99tPx
TLSH
T17BE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilackc.tv
malware.xoilackc.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4892-0-0x00000000004A0000-0x00000000007CC000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	messenger_update.exe
Token: SeDebugPrivilege	5048	messenger_update.exe
Token: SeDebugPrivilege	2736	messenger_update.exe
Token: SeDebugPrivilege	5812	messenger_update.exe
Token: SeDebugPrivilege	5668	messenger_update.exe
Token: SeDebugPrivilege	4004	messenger_update.exe
Token: SeDebugPrivilege	660	messenger_update.exe
Token: SeDebugPrivilege	3356	messenger_update.exe
Token: SeDebugPrivilege	1948	messenger_update.exe
Token: SeDebugPrivilege	3544	messenger_update.exe
Token: SeDebugPrivilege	4480	messenger_update.exe
Token: SeDebugPrivilege	2152	messenger_update.exe
Token: SeDebugPrivilege	3428	messenger_update.exe
Token: SeDebugPrivilege	224	messenger_update.exe
Token: SeDebugPrivilege	2692	messenger_update.exe
Token: SeDebugPrivilege	5108	messenger_update.exe
Token: SeDebugPrivilege	4252	messenger_update.exe
Token: SeDebugPrivilege	5276	messenger_update.exe
Token: SeDebugPrivilege	4960	messenger_update.exe
Token: SeDebugPrivilege	3188	messenger_update.exe
Token: SeDebugPrivilege	2700	messenger_update.exe
Token: SeDebugPrivilege	2184	messenger_update.exe
Token: SeDebugPrivilege	456	messenger_update.exe
Token: SeDebugPrivilege	1088	messenger_update.exe
Token: SeDebugPrivilege	2820	messenger_update.exe
Token: SeDebugPrivilege	3424	messenger_update.exe
Token: SeDebugPrivilege	5312	messenger_update.exe
Token: SeDebugPrivilege	5688	messenger_update.exe
Token: SeDebugPrivilege	2360	messenger_update.exe
Token: SeDebugPrivilege	5040	messenger_update.exe
Token: SeDebugPrivilege	3296	messenger_update.exe
Token: SeDebugPrivilege	2052	messenger_update.exe
Token: SeDebugPrivilege	1080	messenger_update.exe
Token: SeDebugPrivilege	4752	messenger_update.exe
Token: SeDebugPrivilege	5564	messenger_update.exe
Token: SeDebugPrivilege	1064	messenger_update.exe
Token: SeDebugPrivilege	1428	messenger_update.exe
Token: SeDebugPrivilege	4876	messenger_update.exe
Token: SeDebugPrivilege	6128	messenger_update.exe
Token: SeDebugPrivilege	5396	messenger_update.exe
Token: SeDebugPrivilege	4340	messenger_update.exe
Token: SeDebugPrivilege	5168	messenger_update.exe
Token: SeDebugPrivilege	2980	messenger_update.exe
Token: SeDebugPrivilege	3704	messenger_update.exe
Token: SeDebugPrivilege	2168	messenger_update.exe
Token: SeDebugPrivilege	1632	messenger_update.exe
Token: SeDebugPrivilege	1260	messenger_update.exe
Token: SeDebugPrivilege	1828	messenger_update.exe
Token: SeDebugPrivilege	4124	messenger_update.exe
Token: SeDebugPrivilege	2660	messenger_update.exe
Token: SeDebugPrivilege	2740	messenger_update.exe
Token: SeDebugPrivilege	2536	messenger_update.exe
Token: SeDebugPrivilege	5220	messenger_update.exe
Token: SeDebugPrivilege	5136	messenger_update.exe
Token: SeDebugPrivilege	5876	messenger_update.exe
Token: SeDebugPrivilege	5948	messenger_update.exe
Token: SeDebugPrivilege	5524	messenger_update.exe
Token: SeDebugPrivilege	1180	messenger_update.exe
Token: SeDebugPrivilege	4860	messenger_update.exe
Token: SeDebugPrivilege	3808	messenger_update.exe
Token: SeDebugPrivilege	3180	messenger_update.exe
Token: SeDebugPrivilege	2192	messenger_update.exe
Token: SeDebugPrivilege	1292	messenger_update.exe
Token: SeDebugPrivilege	3700	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1140	4892	messenger_update.exe	78
PID 1140 wrote to memory of 5560	1140	cmd.exe	80
PID 1140 wrote to memory of 5048	1140	cmd.exe	81
PID 5048 wrote to memory of 4168	5048	messenger_update.exe	82
PID 4168 wrote to memory of 4008	4168	cmd.exe	84
PID 4168 wrote to memory of 2736	4168	cmd.exe	85
PID 2736 wrote to memory of 2432	2736	messenger_update.exe	86
PID 2432 wrote to memory of 2928	2432	cmd.exe	88
PID 2432 wrote to memory of 5812	2432	cmd.exe	89
PID 5812 wrote to memory of 5288	5812	messenger_update.exe	90
PID 5288 wrote to memory of 456	5288	cmd.exe	92
PID 5288 wrote to memory of 5668	5288	cmd.exe	93
PID 5668 wrote to memory of 2376	5668	messenger_update.exe	94
PID 2376 wrote to memory of 2464	2376	cmd.exe	96
PID 2376 wrote to memory of 4004	2376	cmd.exe	97
PID 4004 wrote to memory of 5656	4004	messenger_update.exe	98
PID 5656 wrote to memory of 1672	5656	cmd.exe	100
PID 5656 wrote to memory of 660	5656	cmd.exe	101
PID 660 wrote to memory of 1668	660	messenger_update.exe	102
PID 1668 wrote to memory of 4900	1668	cmd.exe	104
PID 1668 wrote to memory of 3356	1668	cmd.exe	105
PID 3356 wrote to memory of 2748	3356	messenger_update.exe	106
PID 2748 wrote to memory of 5096	2748	cmd.exe	108
PID 2748 wrote to memory of 1948	2748	cmd.exe	109
PID 1948 wrote to memory of 1588	1948	messenger_update.exe	110
PID 1588 wrote to memory of 448	1588	cmd.exe	112
PID 1588 wrote to memory of 3544	1588	cmd.exe	113
PID 3544 wrote to memory of 4512	3544	messenger_update.exe	114
PID 4512 wrote to memory of 3624	4512	cmd.exe	116
PID 4512 wrote to memory of 4480	4512	cmd.exe	117
PID 4480 wrote to memory of 1792	4480	messenger_update.exe	118
PID 1792 wrote to memory of 4620	1792	cmd.exe	120
PID 1792 wrote to memory of 2152	1792	cmd.exe	121
PID 2152 wrote to memory of 3052	2152	messenger_update.exe	122
PID 3052 wrote to memory of 2496	3052	cmd.exe	124
PID 3052 wrote to memory of 3428	3052	cmd.exe	125
PID 3428 wrote to memory of 508	3428	messenger_update.exe	126
PID 508 wrote to memory of 352	508	cmd.exe	128
PID 508 wrote to memory of 224	508	cmd.exe	129
PID 224 wrote to memory of 5392	224	messenger_update.exe	130
PID 5392 wrote to memory of 4668	5392	cmd.exe	132
PID 5392 wrote to memory of 2692	5392	cmd.exe	133
PID 2692 wrote to memory of 1264	2692	messenger_update.exe	134
PID 1264 wrote to memory of 5600	1264	cmd.exe	136
PID 1264 wrote to memory of 5108	1264	cmd.exe	137
PID 5108 wrote to memory of 500	5108	messenger_update.exe	138
PID 500 wrote to memory of 2624	500	cmd.exe	140
PID 500 wrote to memory of 4252	500	cmd.exe	141
PID 4252 wrote to memory of 2800	4252	messenger_update.exe	142
PID 2800 wrote to memory of 5536	2800	cmd.exe	144
PID 2800 wrote to memory of 5276	2800	cmd.exe	145
PID 5276 wrote to memory of 3740	5276	messenger_update.exe	146
PID 3740 wrote to memory of 4836	3740	cmd.exe	148
PID 3740 wrote to memory of 4960	3740	cmd.exe	149
PID 4960 wrote to memory of 4948	4960	messenger_update.exe	150
PID 4948 wrote to memory of 5008	4948	cmd.exe	152
PID 4948 wrote to memory of 3188	4948	cmd.exe	153
PID 3188 wrote to memory of 2420	3188	messenger_update.exe	154
PID 2420 wrote to memory of 4320	2420	cmd.exe	156
PID 2420 wrote to memory of 2700	2420	cmd.exe	157
PID 2700 wrote to memory of 5420	2700	messenger_update.exe	158
PID 5420 wrote to memory of 2636	5420	cmd.exe	160
PID 5420 wrote to memory of 2184	5420	cmd.exe	161
PID 2184 wrote to memory of 5156	2184	messenger_update.exe	162

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X9U6r66k3Mlf.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JSOTHs6h6Gt4.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KPFELcA9Lfuv.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rYyYFJZYOE08.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fwara8RJZYVw.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bVf3p4hZln4N.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kcNBZEaA19xx.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WZaKTySv8FNu.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M5kCFDLOf88R.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dPWqIx4EF6Ri.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViAhJ8TcnKYP.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WibJu1kz6Q6M.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ctsAwsNLX3VK.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GVaEq1fQL7Hg.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RxLaJOshLgqe.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RMUOKYzx0C0a.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swSF7veXfv0e.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O2gogsYXjkfs.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FpC6C0631IHE.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1HKmn6UP8zIh.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HHkKFlOX4Mnk.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NfkPXMluB7oK.bat" "
        44⤵
        
        PID:5156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mtniT7WNlM8j.bat" "
        46⤵
        
        PID:2556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pHbnWza6K5fj.bat" "
        48⤵
        
        PID:5868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LY7DEqTC8S90.bat" "
        50⤵
        
        PID:3000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EHjIfOezxJQP.bat" "
        52⤵
        
        PID:6060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0mn1KqZtbMKC.bat" "
        54⤵
        
        PID:5640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u7TXoFVeRIF8.bat" "
        56⤵
        
        PID:4500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EfpdGsHKoLkA.bat" "
        58⤵
        
        PID:1252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TKsP3LIACsJN.bat" "
        60⤵
        
        PID:1280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ooTTFtYDJTWK.bat" "
        62⤵
        
        PID:4656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z2iTEt6UbOhf.bat" "
        64⤵
        
        PID:124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D773jj2Ya7KS.bat" "
        66⤵
        
        PID:4556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u1yHhULHbfPv.bat" "
        68⤵
        
        PID:1436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4VB4fYlGTY49.bat" "
        70⤵
        
        PID:5872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DH7JnBI5Q3xj.bat" "
        72⤵
        
        PID:5284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ANVIkw2RCnaj.bat" "
        74⤵
        
        PID:5968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mQLtcwCkyP8y.bat" "
        76⤵
        
        PID:3144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YrTfdmgdRoMQ.bat" "
        78⤵
        
        PID:5348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZtFzNcOg2YIz.bat" "
        80⤵
        
        PID:2856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dIMhey0nSCMX.bat" "
        82⤵
        
        PID:5616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KDkgqtsYewXC.bat" "
        84⤵
        
        PID:5448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WdThKAANPDIC.bat" "
        86⤵
        
        PID:4572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IiFHjwn8ceyS.bat" "
        88⤵
        
        PID:6132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1hVewdDNuv0D.bat" "
        90⤵
        
        PID:3160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lj50wOoS4wDd.bat" "
        92⤵
        
        PID:5956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W0RNScIGEyWP.bat" "
        94⤵
        
        PID:1300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgF6tF5rqieU.bat" "
        96⤵
        
        PID:3500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HALGxhVOEA6U.bat" "
        98⤵
        
        PID:5584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m4Qnal1kPGvY.bat" "
        100⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\998My8nUyALz.bat" "
        102⤵
        
        PID:5796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eqgkaupQbd79.bat" "
        104⤵
        
        PID:4012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mS4UAMPv8JFh.bat" "
        106⤵
        
        PID:3224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3Mefsy4CygpW.bat" "
        108⤵
        
        PID:4456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        109⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FWrtzMjuuF2U.bat" "
        110⤵
        
        PID:5068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        111⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NLy8Uq2XdQfT.bat" "
        112⤵
        
        PID:408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        113⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5qkpHObvsolW.bat" "
        114⤵
        
        PID:1168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        115⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zP6lco1PnnIu.bat" "
        116⤵
        
        PID:6024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        117⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R7izioGAqvlh.bat" "
        118⤵
        
        PID:744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        119⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y2d98tYbenW7.bat" "
        120⤵
        
        PID:5744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        121⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gCGC6qbLMYCu.bat" "
        122⤵
        
        PID:4676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        123⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zzWhGp9NwNmh.bat" "
        124⤵
        
        PID:4552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        125⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\316iiHyPMcdV.bat" "
        126⤵
        
        PID:3632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        127⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j66z74eNXGvp.bat" "
        128⤵
        
        PID:3564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        129⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        129⤵
        
        PID:4832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egsm2oSzsgOg.bat" "
        130⤵
        
        PID:3440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        131⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        131⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dJhOMpS1gqU4.bat" "
        132⤵
        
        PID:5596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        133⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        133⤵
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lkH7bJxShw7O.bat" "
        134⤵
        
        PID:5648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        135⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        135⤵
        
        PID:3416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hKRIHoYKVZyC.bat" "
        136⤵
        
        PID:2572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        137⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        137⤵
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8nZqpEl2ZmMf.bat" "
        138⤵
        
        PID:5612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        139⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        139⤵
        
        PID:4908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VhMWvdO1aizN.bat" "
        140⤵
        
        PID:4488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        141⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        141⤵
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lr43R2GwBO4k.bat" "
        142⤵
        
        PID:4912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        143⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        143⤵
        
        PID:5964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qTWvw4z0hTWQ.bat" "
        144⤵
        
        PID:3272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        145⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        145⤵
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j4gl3eFw2RQ9.bat" "
        146⤵
        
        PID:4516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        147⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        147⤵
        
        PID:3888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3LzFXDOzKZiq.bat" "
        148⤵
        
        PID:2264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        149⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        149⤵
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p22XQSANoIZC.bat" "
        150⤵
        
        PID:684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        151⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        151⤵
        
        PID:4112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UbijN1TgY6io.bat" "
        152⤵
        
        PID:3332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        153⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        153⤵
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LkKeFkslbTMv.bat" "
        154⤵
        
        PID:5728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        155⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        155⤵
        
        PID:5452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qBPWgSDySeXz.bat" "
        156⤵
        
        PID:1188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        157⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        157⤵
        
        PID:5336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuO1ATW8lGOZ.bat" "
        158⤵
        
        PID:1636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        159⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        159⤵
        
        PID:4380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEAAgikyjEoM.bat" "
        160⤵
        
        PID:472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        161⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        161⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hfgmC4wGFN4t.bat" "
        162⤵
        
        PID:6064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        163⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        163⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tfD23VRWjsDw.bat" "
        164⤵
        
        PID:4628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        165⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        165⤵
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LfV1qlmEQdft.bat" "
        166⤵
        
        PID:244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        167⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        167⤵
        
        PID:2488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KNqZcT6fqAax.bat" "
        168⤵
        
        PID:5864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        169⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        169⤵
        
        PID:2592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\K2cJJFQ8kaRp.bat" "
        170⤵
        
        PID:5976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        171⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        171⤵
        
        PID:2080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S4EJaOYMAgfh.bat" "
        172⤵
        
        PID:756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        173⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        173⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2MofuKER3DMf.bat" "
        174⤵
        
        PID:6036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        175⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        175⤵
        
        PID:3092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9LBpRiEqtpDB.bat" "
        176⤵
        
        PID:2072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        177⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        177⤵
        
        PID:4376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DpRqwRrmCLsl.bat" "
        178⤵
        
        PID:5368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        179⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        179⤵
        
        PID:5552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tKWU2HDVN9dr.bat" "
        180⤵
        
        PID:3716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        181⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        181⤵
        
        PID:2280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vDq2KeCOXGAI.bat" "
        182⤵
        
        PID:1732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        183⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        183⤵
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y3yEDMRsxySF.bat" "
        184⤵
        
        PID:5184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        185⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        185⤵
        
        PID:1836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYSFOLqtlC5o.bat" "
        186⤵
        
        PID:2788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        187⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        187⤵
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jzl4P3Uolilg.bat" "
        188⤵
        
        PID:1804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        189⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        189⤵
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUyeGLHCIcEH.bat" "
        190⤵
        
        PID:6088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        191⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        191⤵
        
        PID:2532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pj7hHK5qe0qv.bat" "
        192⤵
        
        PID:232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        193⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        193⤵
        
        PID:1820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gwqFvZXyro4u.bat" "
        194⤵
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        195⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        195⤵
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h2VKDMf2Qlnl.bat" "
        196⤵
        
        PID:2276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        197⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        197⤵
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NZesJVRl7nO6.bat" "
        198⤵
        
        PID:2516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        199⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        199⤵
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DFi2CnWONmbM.bat" "
        200⤵
        
        PID:5016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        201⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        201⤵
        
        PID:1376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CjSKoFirGa4p.bat" "
        202⤵
        
        PID:5008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        203⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        203⤵
        
        PID:4224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ioV4heEHLC8S.bat" "
        204⤵
        
        PID:5228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        205⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        205⤵
        
        PID:3796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Oc8ajWMSnQDX.bat" "
        206⤵
        
        PID:3036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        207⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        207⤵
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J5RzRJMJ0WwT.bat" "
        208⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        209⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        209⤵
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iYKNeNSaeV6Y.bat" "
        210⤵
        
        PID:3524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        211⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        211⤵
        
        PID:1672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BWPJSxy9kD1o.bat" "
        212⤵
        
        PID:3712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        213⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        213⤵
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FWdQQAkWS0sW.bat" "
        214⤵
        
        PID:5096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        215⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        215⤵
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HJ5eUdSEjZub.bat" "
        216⤵
        
        PID:3708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        217⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        217⤵
        
        PID:5440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ie9hrtshDVI2.bat" "
        218⤵
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        219⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        219⤵
        
        PID:6072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z0fYc54WCriY.bat" "
        220⤵
        
        PID:236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        221⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        221⤵
        
        PID:1724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b7EfpFkU5jkB.bat" "
        222⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        223⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        223⤵
        
        PID:4712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lGKq5onbpTFD.bat" "
        224⤵
        
        PID:4664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        225⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        225⤵
        
        PID:1044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C0rmoY9zlDap.bat" "
        226⤵
        
        PID:4228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        227⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        227⤵
        
        PID:4368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OtqCOwyXpC37.bat" "
        228⤵
        
        PID:6008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        229⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        229⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ICJ0QXfobqCn.bat" "
        230⤵
        
        PID:4232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        231⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        231⤵
        
        PID:5080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZcLPtiNyX97Q.bat" "
        232⤵
        
        PID:2744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        233⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        233⤵
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sTPKUuRmeIZi.bat" "
        234⤵
        
        PID:5772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        235⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        235⤵
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VsauHEdu1NT6.bat" "
        236⤵
        
        PID:3680
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        237⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        237⤵
        
        PID:1492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqAxIGyHamDB.bat" "
        238⤵
        
        PID:2352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        239⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        239⤵
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VK31K2gzOGz7.bat" "
        240⤵
        
        PID:448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        241⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        241⤵
        
        PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

0mn1KqZtbMKC.bat

Path C:\Users\Admin\AppData\Local\Temp\0mn1KqZtbMKC.bat
Size 185B
SHA256 1ab13811740a46be4e3269701e069075bf23e9e48e79aef1b6caac668165f49a
MD5 b1c42b73f11ff37813b85883da770b98
SHA1 bf1ea0fcbc11ceceb96cc5f495ca41a925a1b483
SHA512 b59c87c8e6dc72112a1482fa39ddf360c35c7d2a3517162a2588a150faf810f4331143b2a12496c3151172f94540abeee70d538f7ad3346588df72a15265ba52
TLSH
T177C012018181CA5E49045C0B29A9668CF19908996A89BFA045018C9C53D6C69B9DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

1HKmn6UP8zIh.bat

Path C:\Users\Admin\AppData\Local\Temp\1HKmn6UP8zIh.bat
Size 185B
SHA256 91011b6f875df274a75c7eac8b908f1e8e08aa06ef87b586220961da2489dec9
MD5 4940f81b792848a9ab863e03fa3a407a
SHA1 55d164424031e62dd06bf7045b738fbfa3bd71d5
SHA512 8335a66dafa7abf35492134d0ee91aac2155c5b439328186f4cc58271ec295638330051b03e10d744771027d163106d57bb3e6b268a4976658a87de00d67ed40
TLSH
T1D3C0120261818B5E59046C0A19B9678CF19509996A497FA04601886C63D3C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

1hVewdDNuv0D.bat

Path C:\Users\Admin\AppData\Local\Temp\1hVewdDNuv0D.bat
Size 185B
SHA256 ef8ea0c7f84bbc95f5f93f3ca9a62bc1a846c35157c2ec233b2bdad7c8e8198a
MD5 6ab23e36f88a3d88379badfa8ec5d59a
SHA1 7bb3ee578a723352773fd1e42673694b7b8a876b
SHA512 5db22b23501c7713f8c96e50bbc6d5bff4910195e0b93a8ebc222726a829781f5c82d5c732cc5f3c7492731f8ed70138bfa8188c20f93ba52a3875530b942337
TLSH
T12FC012019192CE5E59045C1E19FAA68CF09508A92A497FA44601885C17D2C59B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

316iiHyPMcdV.bat

Path C:\Users\Admin\AppData\Local\Temp\316iiHyPMcdV.bat
Size 185B
SHA256 dc9723950070ba52395e35023f72f343d2821a80c862c901e7aa6a0a3fde88e2
MD5 d45612bb59d6bebcc9043885ff3f36d9
SHA1 f28887c512bb239020fd8341448b1657e1c6044a
SHA512 151acaf00405ab93d57e33ecb52fa5e287edbb029cc62e442ec74c5fb4a576a1b894855ea251cbde68262b47eb40f6f35a02cd8915c378c94cfcb998a2f2a6f1
TLSH
T118C0120151828A6E45045C0F19AAA68CF0D908AD69497FA44501886D23D6C6CB9CF783
MD5 SHA1 SHA512 TLSH

Submit Download

3Mefsy4CygpW.bat

Path C:\Users\Admin\AppData\Local\Temp\3Mefsy4CygpW.bat
Size 185B
SHA256 90c588b0db56bd2f8497836f2828edeb420448596e5489bc89da6513b664a4cc
MD5 1050a33f95b797ade09a79d1a3d5d64e
SHA1 cca77d8af0d7c9ae95e557d3c682a4674cab614e
SHA512 4c00b21fa52a8b0bb5e6e427e69139b1f9ea3c77a459f6dc2acbabf77dfcadf3c1e40466fda578508a8bb6ea6dcd866f58d344d09546200515ec82f43fb39882
TLSH
T133C012014582CA6E49045D0E1DA9668CF0D6089D29497FA04901885D53D2C98B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

4VB4fYlGTY49.bat

Path C:\Users\Admin\AppData\Local\Temp\4VB4fYlGTY49.bat
Size 185B
SHA256 ce1b1488b5deed505337193c5d36ecbc6361beab701962a5cfc6912da19fb47c
MD5 9f44f122363d5cbafb41feeef6de84d0
SHA1 31268215428535cc7556c4d042276cb89ef348f4
SHA512 d76e1fce80f9b5b782c89b37ee6ca251979b1787fa31c04ceb1e382895b6d2ed3ac78be4ab5c7995f881bac0ac068592bd42582b30f872d19da65cdf9fe855bc
TLSH
T122C0121141818B5E45145C1A19EAB78CF096089D3949BFA44601886D27D6C98B5CF783
MD5 SHA1 SHA512 TLSH

Submit Download

5qkpHObvsolW.bat

Path C:\Users\Admin\AppData\Local\Temp\5qkpHObvsolW.bat
Size 185B
SHA256 79e438925a17956c27085b31bbd8fe0eb085826a04b380dcd6727f6234153c81
MD5 29fc14f2168e72ca623a2430ea70df8e
SHA1 99f28115c243254583816343dfdeaa2ba7b676ee
SHA512 f874c00f4b2d7a8b5d142a18722c481a6c0b472af277f466c3c63752c81c733702bbdac4c6e4dc2e7659a1b60a8731d9f24da5a62e097aff0050bbe113fa135d
TLSH
T1EFC0220142818A1E45084C0A08A9B68CF0D9089929087FA00920884D13C3C6EB4DB392
MD5 SHA1 SHA512 TLSH

Submit Download

998My8nUyALz.bat

Path C:\Users\Admin\AppData\Local\Temp\998My8nUyALz.bat
Size 185B
SHA256 41f1a908cd8448c6888cf2de3c9879e8cb27ae38dc488b853dbf5f8f329792cb
MD5 bcb2b6afd62e7f8f922f950427535b42
SHA1 ee2236c9501ded2ed4534beefe43e6f0bf2a2602
SHA512 d8228d1d76fd33eab6bdc26fd0d6c78aba1609cd07e74106973e8457d24061e4b663da60c5d2aa20bcc615dd4753ae04fba92edbb82818eefa5f057834e2a2bf
TLSH
T120C012014186CA5E89045C1A59AD678CF09508AD69497FA08501C85D23D2C98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ANVIkw2RCnaj.bat

Path C:\Users\Admin\AppData\Local\Temp\ANVIkw2RCnaj.bat
Size 185B
SHA256 c4fed50df2c80730da42f7ea594e546f16b086152e00824b1ed973c27f4ed4cc
MD5 7e53212a83e25866077cf317f80e8a12
SHA1 7783cdfd343f42e88c08c227353ebd1b73cd6b5b
SHA512 fb53ce0ff23e8680353ce1a56a7679fa7fe79e9ee1ec2d57d6364f344f0fd0b62285933e9fea015c3190ec68b78585b02432c81c0d8365ea7d3942672898038c
TLSH
T186C012018185CA6E56045C0B1DAA67CCF0990899294D7FA04641C89C17D2C99B5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

AgF6tF5rqieU.bat

Path C:\Users\Admin\AppData\Local\Temp\AgF6tF5rqieU.bat
Size 185B
SHA256 d58495150ef232904a65e1c35ad65059379386dc4ef1161946456f007cea5081
MD5 4ddab7482bebb2d21e98144521f31c3a
SHA1 badedd2e811a116778cdc8cdfd07f7a1b9637761
SHA512 fc382f211f76607ef046b0bde4e75f5825fda4e3552793d08c0bd9235402168b083ae17f387dc82ae2120ec88587df83b55ea06edc05fa0249dd0b499c3079b5
TLSH
T124C012018592CA5E5A545C0A59A967CCF1950D99294D7FA04502885C13D6C5CB5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

D773jj2Ya7KS.bat

Path C:\Users\Admin\AppData\Local\Temp\D773jj2Ya7KS.bat
Size 185B
SHA256 10baa26d98b7540613b995f80ddc374be2de76793f56bb461174e5e91fdaf6e7
MD5 4a27f7901ae59df5da14da214a93e81b
SHA1 6c0a68f2a021def15d80a8036a2091c6d397f057
SHA512 dc5989e6d4e5c96e20a73c7986578e4976ff427de82f1de6c624c7894197751ce711be27633a39082cc990820ffa9288a5324601dc6c21584da308bac5604a5e
TLSH
T1AAC0120151828A5F45045C0B59A9668CF19508A92D49BFA045428C5D57D2C5CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

DH7JnBI5Q3xj.bat

Path C:\Users\Admin\AppData\Local\Temp\DH7JnBI5Q3xj.bat
Size 185B
SHA256 dbe2effa6a2f9482beb7e1a167abb04757c4295f897bbb04c1f40557f90ed27b
MD5 b67de75dc457321378ce07a02abdcebf
SHA1 c5a9076182424595a8e603572e67de7b106837f6
SHA512 1fa7fbc933e9d30d55864f435a33972b03a905bb00efd7018c59eb2b7390847d3451857d89bf90eb06ab8b3caa4b230e1d9029dfed1343dc4cf8a707c9a2784b
TLSH
T175C0121185918A5F45045C0A59A9B6CCF195099D69497FA14541885C53D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

EHjIfOezxJQP.bat

Path C:\Users\Admin\AppData\Local\Temp\EHjIfOezxJQP.bat
Size 185B
SHA256 0103ee0f730c4198dcd52b179740efd0bebadbfd10c7c9b64c3731ab854d4a41
MD5 df2c3541cd984df2d78c3ad330d534be
SHA1 5e048a88b23c1d2c8b00aba550af0c0c82e0eefc
SHA512 137da656a757cad44f13d1b6b9b042f073f832cc6bb5ab4a1195f2889d3b5f7d8801eee4869f2b44983c3ff4cbcde953893e01fe68ab189abf238c3a882f560a
TLSH
T1ADC0120152828A5F46145C0B19F97A8CF1950C9969497FA14911C89C63D2C68B5DF783
MD5 SHA1 SHA512 TLSH

Submit Download

EfpdGsHKoLkA.bat

Path C:\Users\Admin\AppData\Local\Temp\EfpdGsHKoLkA.bat
Size 185B
SHA256 c314ade298c36595916c116420f748aa82bc9b9f91ed6ff9c239b355b252377c
MD5 6b9e28758bdd05c6e5fe8f6bf4486989
SHA1 ecd19b8bc40be050d0ec4fe566e1dac2ebb808b6
SHA512 6d4fabf56a41310f7ed7f4d5b0569c8ac6ad9e9acf2a3376f9cd3ac76197aa58e82ea9a1071698caba2135112e3ab4e07a3e617b5cbcfad70584a2e697460864
TLSH
T16BC0220041928A1E06084C0A18A973CCF09508982A087FA00501C84C13C7C5CB4CB3C2
MD5 SHA1 SHA512 TLSH

Submit Download

FWrtzMjuuF2U.bat

Path C:\Users\Admin\AppData\Local\Temp\FWrtzMjuuF2U.bat
Size 185B
SHA256 245e4ac1e4f6ccd73619d523aa0b081f78f686af5111af3384aa66ddcc137d8d
MD5 b6627b99a9321f89aa46e183c9abdbcf
SHA1 87dd2e79890a28d02d2177ac3ecf33bcc51a759a
SHA512 3b04b0681350b35c0033d0a15a1affda579550450926471b9f812d4aff62cf5169a1e3b4d22c19ae0c4e2ad1ae04d2ba692fa524e0a7bdb5f23988d8d8acfb11
TLSH
T153C0120182918A5E46045C0E19FA67CCF0A50C996D49BFA04541885D57D6D5CB9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

FpC6C0631IHE.bat

Path C:\Users\Admin\AppData\Local\Temp\FpC6C0631IHE.bat
Size 185B
SHA256 091b5d0014a720937bd7a1c9a64b8e1a990a926aaa9c01074a306c04000cfc99
MD5 a988da533bcf40614259c8fe25f8b6c4
SHA1 fe2baf0385a18c67c96d66df2b62ad1bad956c9b
SHA512 8e1e5083daed627da1f66c76ad0fa60cc1cdfcee293dadd08af44165712e460497c16f7574e49273db35a8587ed89752bd012f41ba766402c47fc09c670ab443
TLSH
T1BDC012114585CA5E46045C0B19A9768CF095089D29497FA14911C89C13D2C58F5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Fwara8RJZYVw.bat

Path C:\Users\Admin\AppData\Local\Temp\Fwara8RJZYVw.bat
Size 185B
SHA256 0928318340cff863cb6363adbcbd8423297a0650752914053956082898ba0c89
MD5 28efb5ec0fc73fe00976bd3c28b7c16f
SHA1 b7f9a19883c5699814ac97953d32b7d55a83c84e
SHA512 d627e5b27bbc835c61d8b2ec0f10c95cd4fed4968f22ffca9fa7e57fd8a710a62c9d1bfd126e598edb2fb4d8a4e857b4cea6b68bdbd3893fef6e8967d0fd8f9b
TLSH
T114C0120541928A5E56045C0A19AE668CF0D5089D2E497FA549418C5D13D3C58F5DFB82
MD5 SHA1 SHA512 TLSH

Submit Download

GVaEq1fQL7Hg.bat

Path C:\Users\Admin\AppData\Local\Temp\GVaEq1fQL7Hg.bat
Size 185B
SHA256 b5180422d0e500a2c01122daab5e9be140e5e7583d8c72c49e6a541190215063
MD5 053dc4366266a28c2e7aecfb4ab8e82f
SHA1 1315861c4f17b7bbc92650e417748c6344000a56
SHA512 26e8a6e56299eab4e351c71c281ce4ae73b09bf90809ec9f094e799d418935f7819c9b4b97bf5abe4d61e1b9892c1f158a82fe9fd5e2de737f945b941643b5b1
TLSH
T1A6C0120141918A5E4A045C0A19EAA6CCF0E90C9A2D497FA44511C85C13D3C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

HALGxhVOEA6U.bat

Path C:\Users\Admin\AppData\Local\Temp\HALGxhVOEA6U.bat
Size 185B
SHA256 3d5ef2f3311181c5d36d28f0b0028c614e188d3c38a94bc2d28fcdc0ee01026d
MD5 b7f241379d23c3b1886aa7dcbb01ec99
SHA1 70458131cd8002b3d87b871a7b34ade3c6f1c80e
SHA512 486c4074feec3909d1da411fd7575da8e52a1ea1a92b9e759dfaf1d1946d37eb7697b1bb6d1a56a620a605541f99b6db6506ed45eb293d86015d46b97d1ff009
TLSH
T1ABC0220041828A5E06004C0A09A963CCF0D50CA82908BFA005008C9C13C3C6CB4CB3C2
MD5 SHA1 SHA512 TLSH

Submit Download

HHkKFlOX4Mnk.bat

Path C:\Users\Admin\AppData\Local\Temp\HHkKFlOX4Mnk.bat
Size 185B
SHA256 524ddcf7eab71892560caaae3655621d1c3534d83de2c76609d46b7f20f96c55
MD5 48368e99b89ceb2ea50a01f4c0079f00
SHA1 c617d0f5af9e31ac951feeaffd59f4be0b03c7b6
SHA512 43f6673a72457360595e99c7eca7c230dcecce5f747dd0815e34c55e166d5ddb92ae77843a8c6efdcad59e5bf13fe63500db5cf0429d0adfdc3f800a3cc7117d
TLSH
T11EC012414182CA5E46045C0A59A96B8CF1A6089D2D497FA04911885C13D7C59B5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

IiFHjwn8ceyS.bat

Path C:\Users\Admin\AppData\Local\Temp\IiFHjwn8ceyS.bat
Size 185B
SHA256 b36d872fa921f0a919f9121e38b95ae1a691ba311eea0e4f2c0081a6f3b935a9
MD5 1eff9b9058c5c716acf9e69a3c3f1aee
SHA1 7805e06edaa4cf5e183a4c4144d5016844797c50
SHA512 02fcad22c1782a1c49e1e28c7b2b2b857f37f7d4678cf7574ea1f79040fab7ab4890638bf0cddf7672a129336383db5d4899cbf03d36c9dd6c4975c15815afc3
TLSH
T177C0120141918A5E46045C0A19A9A78CF099089D2D49BFA14901885D53D2C5DB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

JSOTHs6h6Gt4.bat

Path C:\Users\Admin\AppData\Local\Temp\JSOTHs6h6Gt4.bat
Size 185B
SHA256 ef35d6c68f00d5c2c5af37014b44f27b1eb599f6032dc26b19dc455e59ba6093
MD5 fec531de42f4fc4dc9428c3b110d8d0f
SHA1 985feae897529f3f8768fdf73f46adc69ba6a6c6
SHA512 00e7c53fd03a89eb59f3caa22214289a9459e6e6db1ff2585862ea78f996ff6ddbda92687aae4293c62d08eed886890caf446df9d94d4f998d918f1aca4d7080
TLSH
T1A2C012018191CA5E45085C1A59A977CCF0A508A92D497FA04601C89C67D2C5DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

KDkgqtsYewXC.bat

Path C:\Users\Admin\AppData\Local\Temp\KDkgqtsYewXC.bat
Size 185B
SHA256 c1bb1dd132144f2dddf9f6e52f76f8e9d13c185c48df28e6d272fc299f4a57b8
MD5 337e52dbb361c74bdcb381a1040a657c
SHA1 13004e17b946c0bf02b0faf56c93538d2f0cf11c
SHA512 3d2ac8c1ce75199b986e954781cb4c3676688020cf5a3d1545b38372a8cdf179ba4c8e775f28651541c0db9b7dc288e2951eae8207a6e79bfc8de0a413bf7475
TLSH
T16DC0120141818A6E4A145C0A19AA76CCF19609A96949BFA446018C5C57D2C6CB5DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

KPFELcA9Lfuv.bat

Path C:\Users\Admin\AppData\Local\Temp\KPFELcA9Lfuv.bat
Size 185B
SHA256 3152cd95be6ec3371e347c8832d748d0f42241e357a6507124fbe22807e8132d
MD5 46dee48e6ea5849c7027c2ed558b94c2
SHA1 b0f4f8f35a282967b09995030b3e156f9de47a46
SHA512 0fe00fdde67a67ff3951ee04275a29eb19251697f1d39b326bcb230c7e75e8e900eafccc454e3a9faed2c838cd3cf614f519cb18e3657d96f618b00196f65ab3
TLSH
T1BDC0120181918A5E59045C0F19AAB68CF096089D29497FE045018C5C27D3C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

LY7DEqTC8S90.bat

Path C:\Users\Admin\AppData\Local\Temp\LY7DEqTC8S90.bat
Size 185B
SHA256 20044797e83da61ac4a084016ba063279a29b904c7ae46eb20bd222cb6dc041f
MD5 3e9760fd7ef22b2d665ed1dece3a8ca2
SHA1 484ebbd14ffb2c25e8fd53fa364d37c414a062ed
SHA512 c37f671bf708b774da1dd9f76835a637fc2fdf93381642475f0db3448264b098c4237a0bd82983041c34b74f01bc8f4c2be244cfdc0c45cb3585b68ef553be5b
TLSH
T169C0120141818A5E45145C1A29AA668CF0D5099D29497FA04901885C27D2C6CB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

M5kCFDLOf88R.bat

Path C:\Users\Admin\AppData\Local\Temp\M5kCFDLOf88R.bat
Size 185B
SHA256 7adcdcb4cf5f445b5d37ec9aa9c9d670b98084cb5bb987653776a73d6e7e9f8b
MD5 6c63353aebeb3eeb9d8541ca95f75b07
SHA1 4b7e2860443565f135dd128ea4281e1eee5fbc07
SHA512 b17ed559c9d3d613f9d7b19c3f5c0a256565ca85b8ceed81b9e4a406c0ec61b33e2c4a8531f797b98bb83bb307d31074152b77988652caf4112968678398fa8e
TLSH
T197C0120185828A5E46045C0B19A9768CF09908A92A497FA48512C89C53D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

NLy8Uq2XdQfT.bat

Path C:\Users\Admin\AppData\Local\Temp\NLy8Uq2XdQfT.bat
Size 185B
SHA256 c6182d3bd6b2c79bbb442a6ecd32b1afe38b35d0f42c6978bf9e6aef6125cc07
MD5 13e310e086a02b27bbde97a5c62b1daf
SHA1 02969390de97b05e185f5c0f50006bd85990c9a9
SHA512 369752b7a61d2baa0c2735c7c9cd5aac362c5839739b4da4d199c187c1e4c601471e9581fe514ca1493529bc17909dc2975eb5a78583da4ee5853ea6438633e6
TLSH
T1C0C0120145818A5E4A045C4A59EAA78CF19608992949BFA04511885C13D6C58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

NfkPXMluB7oK.bat

Path C:\Users\Admin\AppData\Local\Temp\NfkPXMluB7oK.bat
Size 185B
SHA256 401d9d1504a474dc3d3c381824398bf3d1236cfbf2bfb762484b21e84d8ae352
MD5 8fe076455037e8f9968f4362727809e0
SHA1 82e829018222715e11f89c25f98193e40104ba7a
SHA512 d85dd912f9a631c9472c55a43ce87b6bb2ff458b6675fe1a423b768f67d758f66417f79a9378adcacf5299c03f88eb7c418c21d00183f976af539be1a88f0175
TLSH
T140C012114281CA5E45145C1A19A9A68CF19A08992D497FA04941885C27D2C6CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

O2gogsYXjkfs.bat

Path C:\Users\Admin\AppData\Local\Temp\O2gogsYXjkfs.bat
Size 185B
SHA256 d822a6e1f6e09a3adafd0751e313791247a848756a2bb4d80bf1b61faaba0b3c
MD5 bee56956344290064620365aef6f0172
SHA1 109bb8fcc38744bbc8ec0016f04e003779f2dcf9
SHA512 324fccb59b6ee30b03db85a51fdb9b0bdab53b8259124b1b0fe1ae29f15eb076d77c40f671400315bc053c12fad53d7a125f174cc7b30cfd064b143102686ac5
TLSH
T120C0120151818A6E5A045C0A19A967CCF095099969897FA04511CC6D63D2C68B5CFB92
MD5 SHA1 SHA512 TLSH

Submit Download

R7izioGAqvlh.bat

Path C:\Users\Admin\AppData\Local\Temp\R7izioGAqvlh.bat
Size 185B
SHA256 75499e42a3e45986f8b35e167bfaae5c9163d2bb9ad0e0dce3bed105e5c83847
MD5 b1722f1778c822369be9648800bf9d2f
SHA1 557a97c0d19b309c08cb3f0d761be2f5c0ce193a
SHA512 d63fa011a2ca7aaa435307a5ba4882b320c2b68a85c6aa2a3a6d7a4ac49e4170f610e277f207c52dff6e606d2bc03280cd0469ef2fdb090a104056f7f234918d
TLSH
T1A8C0120181818A6E45185C0B19EA668CF0960C9D69497FA04511885C17D2C98B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

RMUOKYzx0C0a.bat

Path C:\Users\Admin\AppData\Local\Temp\RMUOKYzx0C0a.bat
Size 185B
SHA256 e0e297e2e988f5cf6af66f3346d05028645594752d2863afeddbdd7ddf09b815
MD5 315c90862e20aaecfc5e9acf9eaa3222
SHA1 32ae35b8096a44ba0e2b8e065edaf94c7621846d
SHA512 0dc6efa3730c68a1f198f99062e4f0a89fb559b037cdc18a4cabd1ab222154123859ab7b61bf59f9bf6319769fea63fc6986c66d698bc9635c2c33853dcf8f4a
TLSH
T1C4C0120145858A6E49145C0A19AA66CCF1A609A92A497FA145018C9C57D2CD9B9CF786
MD5 SHA1 SHA512 TLSH

Submit Download

RxLaJOshLgqe.bat

Path C:\Users\Admin\AppData\Local\Temp\RxLaJOshLgqe.bat
Size 185B
SHA256 afbe191251f9bacdeb213e02ba6b847f1a3524b211028e6d8c9c410999503730
MD5 bf5671b6c4d3b6886ed80aac149617bd
SHA1 ea00d1b7c38986b3b1e82efa1e6cc0109ddf131a
SHA512 6ceecf60dea584be88d88f874b77ce421db8ad153131e93f1c71b539dc8bbca45791cd426c7363d66b9799fceb100941801ede12c7bd3b8b2aab7c07f2761025
TLSH
T152C0120146828A6E45045C0A1AA96B8CF19A08996949BFA44A11C95C13D2CA9B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

TKsP3LIACsJN.bat

Path C:\Users\Admin\AppData\Local\Temp\TKsP3LIACsJN.bat
Size 185B
SHA256 cc991fcf1a1fd5a53289c51afddafddfd32bf46562bea1d34e63c19379fc7a9f
MD5 e9968a149ea48476e67135c68aefe92f
SHA1 fda044b6a4bcb515ddb998462e040d840c95a789
SHA512 876827e39ace1270fa7322c90dd5af631d824d186d398a7a4debbd5e46f0e9752d75c48e0dd221c376215982dc3475c155051c784a46501afc0742d375761939
TLSH
T105C012014681CA6E59145C1A19AD678CF1D9089D6A49BFA04901885C17D6C99B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

ViAhJ8TcnKYP.bat

Path C:\Users\Admin\AppData\Local\Temp\ViAhJ8TcnKYP.bat
Size 185B
SHA256 aaaa4057f546ad19b55638f4a01796ee59cdbf1cceacaa35b4313fc36418dc58
MD5 fd34a1aa1f1510f14538e89cdee3b238
SHA1 5676b6756df502550a3c15f357c50c402fa2cf20
SHA512 fc4f57eac59c08a61d9eb4fa7018e3b79a08804af0094540882aa92da20058d5774ca495ccd888e130f6fd6c1d4ae614385a9c508a021c633b8cc81310db7fc1
TLSH
T166C0120145C58A6E4A045C1A19A9668CF19509992A497FA04601C85C63D2C58B9CF792
MD5 SHA1 SHA512 TLSH

Submit Download

W0RNScIGEyWP.bat

Path C:\Users\Admin\AppData\Local\Temp\W0RNScIGEyWP.bat
Size 185B
SHA256 5ae7a24575a1c96ce1db0c52e7bf6b2dc83bd7602a60d51caea71c08ae5a4ade
MD5 42d938d43b75730f2c9e0c8f884d1356
SHA1 d19153a689d5bfe1d137bba48355a129efc3526e
SHA512 f2bbe569cee972736dcbcc1f08825048d9bd813431980fb00b0058993abe4e7723f2483563d9822b27afeb2c57e750bdc4a2c9de9b17888a86a78758bd8bf8ac
TLSH
T16CC0120181818A5E45145C0A19B9A68CF0A50CA92A497FA14502885C27D6C9CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

WZaKTySv8FNu.bat

Path C:\Users\Admin\AppData\Local\Temp\WZaKTySv8FNu.bat
Size 185B
SHA256 3aa2a3b0277d0f1fd17bfd8c0f9fdbd603f933632152edd5379e1b62992c1a0d
MD5 8f60d8a72490b6b92cfe0a04af3409f5
SHA1 76d92bc8146aad352ce9869c64e3dde567f0ca9a
SHA512 47948c4d37f1c315b56ac53f720f4131648df8308a4144ccf93c0fd162ab7e9488a5731fb1221c0f14996e4ebcbbbd689882e9619be94411c8b2c44b0eb832d9
TLSH
T103C0120141918A5E56045C0A19E9778CF0E508B969497FA54602CC5D13D2C6DB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

WdThKAANPDIC.bat

Path C:\Users\Admin\AppData\Local\Temp\WdThKAANPDIC.bat
Size 185B
SHA256 fff1778ca417ae7f0df1d6f5c5c8d2cfce24f70bb75e461ecce93f5c19ec13ab
MD5 9a5d4331e3e0734027ca8001ed6c367b
SHA1 302289ecc908809d6c262cf5ab06a5f12cbfecdf
SHA512 775895b7bac940355bfd0390baf842e9d0151483c87e5177e7124122e555a1d1bd5ff3e75886852550a48529c343730d19331b3923f852cd6e19d1b2c2c1edb4
TLSH
T1F1C0120141968A5E99045C0B19AAA7CCF0A5099D2D49BFA14601889C13D2C68B5DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

WibJu1kz6Q6M.bat

Path C:\Users\Admin\AppData\Local\Temp\WibJu1kz6Q6M.bat
Size 185B
SHA256 97fa13fd4b644f63353525e90b7b92c1142f0ae28919fcfadf8ed66fb32b6091
MD5 c41a822a2b7158c0018ee02cef58161a
SHA1 488e44a9734cce4efc79ff7da6fbda46a13ab6ca
SHA512 2fe61c4551e2f53b6b46ee7b00ae8973dc130fee639737b579aa7fb240f3665816b2547aa76b74bc11720795e4940290c1c6d2206b3cd20906782ea196cc9955
TLSH
T1C2C0120151918A5E45055C1B19AD668CF0A508992A49BFA14A41885C13D6C98F9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

X9U6r66k3Mlf.bat

Path C:\Users\Admin\AppData\Local\Temp\X9U6r66k3Mlf.bat
Size 185B
SHA256 659c181411a504bb35a53fdf051868efbc472797d25005cf89ae56496ffc7534
MD5 9c44504cd9964a06b2e5c50880416189
SHA1 976e8ec58277087d329002e5704d31d43892ed36
SHA512 a8c8d1ca53e6994d671e80ef9789e5047fe94a70428acdd1c0fce4322257ee1f0ea60db48faae1cd05ada2657bc2f634be1390717365e64b2ca18dbf18ca9841
TLSH
T130C0120155918A5E49045C1A59E966CCF19909A96A49BFA04A01885D13D3C98B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Y2d98tYbenW7.bat

Path C:\Users\Admin\AppData\Local\Temp\Y2d98tYbenW7.bat
Size 185B
SHA256 c4db5966876c0d7c165b0d88bc221e4e59fc778fd3aa78c2db63ae01118a1143
MD5 1499f87645cb3a6513d7efe90ff9de3a
SHA1 5f5253888c4de2191f3f9c2101a04d93b2b62464
SHA512 c8a15cd22ade259c1758686d50c1d2df8aa5f0b68bc040962edb570df9f9b7a194bda9ca0d4e3907de5a448713d3cdca2ea5097d825811f2a0951ec62cd8260f
TLSH
T198C0120142918A5E56145C0B19A9678CF095099D6A4A7FA14601C85C57D2C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

YrTfdmgdRoMQ.bat

Path C:\Users\Admin\AppData\Local\Temp\YrTfdmgdRoMQ.bat
Size 185B
SHA256 dc0a00437524a27a3794409673f932bf61d1e309f3212c8941999f8f9858c8fa
MD5 d50d2caae6d7587b10ee692e7fb240cb
SHA1 cc5b5e8d3e6ee1e05fd34e7f1259b81aa3657a17
SHA512 1d40f6f8eb82073fee58b59ccea87605b2e69126ef4e117549d2017b405dde0fa3b7590b690a85fe7e2eaa1e7f2dec2e7e519f1e575c38e856f161ee656f2de1
TLSH
T157C0120141868F5E46045C0A19A9B6CCF096099D2949BFE04D01889D13D2C99B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ZtFzNcOg2YIz.bat

Path C:\Users\Admin\AppData\Local\Temp\ZtFzNcOg2YIz.bat
Size 185B
SHA256 a6f82e7efdc1014c7387d7a143555f613af233e12b93b10b9bac6503b07af50e
MD5 acb5c2d33a18dbc237cdd26e76a7acc9
SHA1 91e071aec3b649fe6b61c6e5819c6f07775cbdf4
SHA512 e07798de91ecb11ed21a4bb2cd8dd6dc7cd2d23b4efddb3c73a5dbccc65f12a975c6d2bebe442f387728dc6be9a22b70bda4063b993edfe0698ff66f84cc9cf8
TLSH
T148C0220041818A2E46004C1A49EAA28CF09509982E087FA10600884C13C2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

bVf3p4hZln4N.bat

Path C:\Users\Admin\AppData\Local\Temp\bVf3p4hZln4N.bat
Size 185B
SHA256 49a45742b2e7b7d2daa11da751fa7030fe087132169d098d83ed072fbfe1472e
MD5 d24cf95a29058b58473ece39248b9072
SHA1 d8b895fd326007eae8ebf5beacdbe513cfcfcac8
SHA512 677711b82dd3947bd14eb5299f7f53734751c9021c8db3be2d50552eae3e6d141bf29ff6e12a6d6ae10623c40808647a53abc20bd69063a71d677431ac3cc423
TLSH
T1BEC0120142818A5F5A045C4A19AA668CF0D50C9969497FA04901889C53D3C58B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

ctsAwsNLX3VK.bat

Path C:\Users\Admin\AppData\Local\Temp\ctsAwsNLX3VK.bat
Size 185B
SHA256 6364b88c68386060a8f997509ee455d514a492e2207fea9743f7e5f4aa067a57
MD5 e5b2db938349a5bc65d0fb8ca5e5f8a8
SHA1 6408b92a19061b1dccc3bc05777da0bdcde4799e
SHA512 e1dd474cdb08b4d1ba2708fa7d5ab3848bec587dd4fbe165684803e0c61e30e499410ed610143d190e7d6829cb2d4aab8820628136ba61207c96a7f2589cb78d
TLSH
T1D1C0120146858A9E46045C1A69EA768CF09508D92E89BFA04951885D33E6C99B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

dIMhey0nSCMX.bat

Path C:\Users\Admin\AppData\Local\Temp\dIMhey0nSCMX.bat
Size 185B
SHA256 2347aceb17b734a8460bfc7e4a3c398d22186c01f3782f2e330a26bab32db646
MD5 ba03a0ac939606812a4aecf23f5e799a
SHA1 34226b79b3d81d547d4a990bd5fd8ebc7418503f
SHA512 c56b8c8ee4e8a240ceda55eb1ff98072c177635a5038f57ca464907708b2c6efd9f4119f67cf55af48f9c88013afeab4bad645c06c9b88ead8c419985092c13a
TLSH
T159C0120152818A5E45045C0B19A9A6CCF0D509992949BFA08541885D53D6C9DB5EB792
MD5 SHA1 SHA512 TLSH

Submit Download

dPWqIx4EF6Ri.bat

Path C:\Users\Admin\AppData\Local\Temp\dPWqIx4EF6Ri.bat
Size 185B
SHA256 6b82928260de51a65be7314053ec7f597f0212602e530d4bfc0c2a38804c48f5
MD5 2eadf3611bf16ccede61522b15753585
SHA1 6941d868f492c3c6bc68a966d0bfb709a5eebfdb
SHA512 8260a4df8b19e309caf30ab8b503b51c02cbd20fde1a24519a2db4b4b38ed5752f22126b221bb4845aeff9e6d02794a9a41533c9647008013499e6ca931d45df
TLSH
T171C0220041838A1E46001C0A08A9628CF09909982A887FA045008C4C17EBC98B4CB782
MD5 SHA1 SHA512 TLSH

Submit Download

eqgkaupQbd79.bat

Path C:\Users\Admin\AppData\Local\Temp\eqgkaupQbd79.bat
Size 185B
SHA256 25da1893913c7a187d8af73b5933ca4df9c905a33075ba95ae91104db1b69b67
MD5 321ebbbf3a124920489860a78a299280
SHA1 d984a5f7c08842200aba41a84de4a8a76e2a8cdf
SHA512 b901cb543cbec771ffcf8e0fe73b9889eef7286bbd61940900ad8d625170f23a1aa4e77c314545c71b221554b47324fce1c1ea7d515f164b6eb9f5eba2e95978
TLSH
T188C012118185CA6E55145C1A59A9678CF0D508993D897FA04911889D23D2C98B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

gCGC6qbLMYCu.bat

Path C:\Users\Admin\AppData\Local\Temp\gCGC6qbLMYCu.bat
Size 185B
SHA256 3ddddc25c36f8a090335904c57d61464b5fdad63b3f4b61a9562f38f7bf2f529
MD5 a3fa86440288c55da745676a6bdf0cdc
SHA1 77eaaeeccaa285f6681fc80db07ede83a2c43efa
SHA512 3ba5a19b980ded6a1e725e41984c911202e0baeb6c029636adb7835f6a500c7ade1162e028166d9913b5bb4a0768f8faa4fa7974a68cc72b0c19dda0ea7fa504
TLSH
T194C0120141828A5E95045C0A19AAB68CF096089D2D497FE446118C5C63D7D9CF5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

kcNBZEaA19xx.bat

Path C:\Users\Admin\AppData\Local\Temp\kcNBZEaA19xx.bat
Size 185B
SHA256 396dbcdd3a246b78d84b72ff257f01528229e5851b5f1068846858b0f90b0338
MD5 c13d741eafbbd4c82b34519a9adfc1a0
SHA1 fe037d7cf1434d8795bcd41b0257a2cc9b161352
SHA512 c9ddae46424127791ec98ff4c1c25b48df1a71f45aa06f737a0af40d0862ed694fe680d3abd2a06d35675c92b1df1e279cd89dc2ada498108877c9d6aaa984a0
TLSH
T1F2C0220081858A5E05542C0A08AA628CF09A08A829087FA0060088CC13C2C59B5CF382
MD5 SHA1 SHA512 TLSH

Submit Download

lj50wOoS4wDd.bat

Path C:\Users\Admin\AppData\Local\Temp\lj50wOoS4wDd.bat
Size 185B
SHA256 9997ed3b16b5b4315a4888250009b83ddefb426d18ab00627d860431f19ff67d
MD5 e1fee0f60156503d39cbf4c5b5e9dd79
SHA1 fa5827a7a5b0dca1b01a22120d3eed531c5f2236
SHA512 d6ef98309359207f57cc545502ff3a57d7104d5bc3bdd446ed2ff08ea7d0acf87cc805d396fb580116225a4e792cfeb8dcd944583164dfd6e2e39f958cb35196
TLSH
T137C0120185818A5E56145D0B19A966CCF095089D2949BFA545518C5C63E2C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

m4Qnal1kPGvY.bat

Path C:\Users\Admin\AppData\Local\Temp\m4Qnal1kPGvY.bat
Size 185B
SHA256 6c99a138045d4130807c1ccf8773267eec80c9e585d1fb09cbb1824dca7b9fac
MD5 05a0da32e602b158c5d63e773af347e4
SHA1 0c01f58e635cc439be69da2d2082df73e519e843
SHA512 e786b5010d5bddc612a9a0482e9ddf61de4819281a2bdc6c73e175b6a08faa5a172c59052aa5b853c163c5e97c1754fae6ec800c801cb04f9a67727319767f70
TLSH
T19DC0120152818A5E49145C0A59EA768CF19608E969497FA44901C85D53D2CA9B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

mQLtcwCkyP8y.bat

Path C:\Users\Admin\AppData\Local\Temp\mQLtcwCkyP8y.bat
Size 185B
SHA256 1ed1195a842fadbed707579f693c98ece817a8ff3b06e7db4debdbce449d5c99
MD5 0f0b8b293f9d37d2127581f1bda423af
SHA1 d6912afde56ebf3e1c03c9aec00cf0af05fe1df6
SHA512 6ec29b22705f7669839661de1065a0ed935bdadf89099c7bfe76d10619ea10a065efb675a9835769a64fb7bb53b3f875c084d164f2516eb09bd693ae7281b762
TLSH
T1ECC012115582CA5E45045C0B29E966CCF09608A9694E7FA04601885C63D6CA8B5DBBD2
MD5 SHA1 SHA512 TLSH

Submit Download

mS4UAMPv8JFh.bat

Path C:\Users\Admin\AppData\Local\Temp\mS4UAMPv8JFh.bat
Size 185B
SHA256 6fcbbc5905cdf9cf687c00bb01b3987ea16b0f32646d4c196c8278d652623e28
MD5 129e53ab6ad232e730f8156491817b66
SHA1 5dcf964f9804e0c29c1d9963a96274b6f32a05f7
SHA512 e714ef48cfbfbf0fa1e76cea8293106d57f02e4a916e6b5996c5dbb792eca4e3819f32b3060bad8a487d5704247adf6ab8a0f636864ebfa505f5fd716629d8e4
TLSH
T121C0120142858A6E59445C0A19EAA78CF0990899A94A7FA045018C5D13D2C58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

mtniT7WNlM8j.bat

Path C:\Users\Admin\AppData\Local\Temp\mtniT7WNlM8j.bat
Size 185B
SHA256 bbbf11c483e885316862c717825f04d0c7b46a5e78f62c7963cdeb46c94aa2e9
MD5 de600b0abc6a24eb2ac9c9e69e7a1b8f
SHA1 c06fba94e76ad3933036108f03ca91e62a1bb109
SHA512 a6943a95aa4553b0bfa88f8bcdcce4ae13f42194cbc9cd130542ef5eb123e05dc1386c82dc4645a0549cdc073deb0a709bba6cac5a2fc4126b899a5e2e4943be
TLSH
T124C0120142818A6E5A449C0A59E966CCF19508996B497FE145418CAD13D7C58B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

ooTTFtYDJTWK.bat

Path C:\Users\Admin\AppData\Local\Temp\ooTTFtYDJTWK.bat
Size 185B
SHA256 499fc8df44cb6ee3a28b28dd4c307cbe30c48445424b9259646846bc1a7a8e3b
MD5 2e58439344e9b739638c3872f4e054af
SHA1 7cd69e8b00df6be06fa4bf2590b2dd705dd96844
SHA512 738a410c4433d9f0f38f60e095bfb524a295817b7af2d907f81e614813bc71675ef6e359603b7e3a91d570616ca370b3d2470504f0cca278b576d05fca10b4b0
TLSH
T1DDC0120142818A5E4A545C0A19A9A68CF0A6089929497FA05511885C23D2C58B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

pHbnWza6K5fj.bat

Path C:\Users\Admin\AppData\Local\Temp\pHbnWza6K5fj.bat
Size 185B
SHA256 3c4e4c6de87592b74b553b53d5afa327bc4a84ec346daafc394ef12e7cb5ef0f
MD5 1468150b6200086ebb12e4d02295789c
SHA1 46ef43ebe593310f517bc297cf31a1877fbbd653
SHA512 988e944e9a0f44a57802507c36db8b3271268747ab4a3e9fc2c3175c82b80358a78df4a55c9955f22cb06140074cab65257ef5ec3074af18f8ae3dedd136bdd2
TLSH
T193C0120182818A9F45145C0E19AA678CF09508A929497FA44A41C85C23D3D58B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

rYyYFJZYOE08.bat

Path C:\Users\Admin\AppData\Local\Temp\rYyYFJZYOE08.bat
Size 185B
SHA256 aa395ea17006dbb3e6d86c251097f1e05de8c133a0c1eb32342a7e74ba6e9f5a
MD5 76970e4919e2e5eae0194c2b41ccd257
SHA1 e77585d6345b87ef2041d6ab6d9054a096d8ac92
SHA512 a5d6a8765bd6747cf7d4f432876087d911a6693b2bfb3cd48440e1a3a3363db531f44e40209329055a25e8e676e4fba585c8321919147ef9b454bdf8221ae0c7
TLSH
T144C022008386CA1F09000C1A2CAA628CF09508A92A087FA00600C88C13D3C58B9CB382
MD5 SHA1 SHA512 TLSH

Submit Download

swSF7veXfv0e.bat

Path C:\Users\Admin\AppData\Local\Temp\swSF7veXfv0e.bat
Size 185B
SHA256 6094b37baf8b7c15bbf94ad3040f7af1914ca8d181b64e6a7d516448a0f1ea0a
MD5 ee8aa3c0faa3e0b0c22d2b80b63757c1
SHA1 a847ca6ea065fd2a80b3ba582a7144ac1d5daef4
SHA512 1c144606ed394422acd283dd0a7d469aeb19809670ea52a5d2e3ed85bbca4117a9a68acf52b44742e416c20d74ddc0a64c7e3a92d0987cc57b4beb39e7d4c672
TLSH
T10DC0120181C18A5E59045C1B19A9668CF1D608996B497FA145018C5C53D3C98B5CF793
MD5 SHA1 SHA512 TLSH

Submit Download

u1yHhULHbfPv.bat

Path C:\Users\Admin\AppData\Local\Temp\u1yHhULHbfPv.bat
Size 185B
SHA256 f15122b5bf0b1778a97c67ab945fcaecfaf89720c21be7fc1c27e33a45ab636d
MD5 955eb2c966973c2c7fc27b4dacdfc536
SHA1 9cb0bdacaac391dba703254e0bb603ecd3bb1940
SHA512 d13cc21f4c4277110c67950ae62e61722c1207ca3dbd5c1ae1ee61c98c649dad1f0adfbf9cc89243f02f6bc0dd383db12ac29b04a09647e78b0b9fe7b239076a
TLSH
T119C012015181CA5F46045C0A1AE9668CF0A909992D49BFA445118C9D23D2CA8B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

u7TXoFVeRIF8.bat

Path C:\Users\Admin\AppData\Local\Temp\u7TXoFVeRIF8.bat
Size 185B
SHA256 ed3dc8e54db1905bbad84d09c487c9dfdf28aaf7e4b40595911749a72d7a01b0
MD5 b8b128439c7d9fe764aa952161963897
SHA1 41977451fbbf9763cac23942f08129c16a6f2807
SHA512 fe199e3495b6caa00e583a30cd5187f4daf1f81bee056b0589a83a1b604b8735f3545d9c6dae3c272646433cf9ed73b6cd3ccf8a5548c844344dc69e70c1f997
TLSH
T197C0124182C58A5F46145C1B19AA678CF0D5089969497FA14601889C13D2C99B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

z2iTEt6UbOhf.bat

Path C:\Users\Admin\AppData\Local\Temp\z2iTEt6UbOhf.bat
Size 185B
SHA256 147b5b6d0f7436667d0a455262f2fa0a83a1889f3a6ec063f5ef5fa22a17c42d
MD5 439d0721cd23bf51b0dd8bae9246ebf3
SHA1 a66011a1fb6ad7abd60095c14268e3cbe01dcf4f
SHA512 38329b3aae9d7d69ff59b0884d7623e2911318e979501263bbcb7498fda191487bbe6646eb14d256f3dd51ca67fb0a187437aaa8bce8e3fb4c148fa7cca77979
TLSH
T12BC0120185859A6E45045C0A59A9678CF5D908AD294AFFA04541885C13D3C58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

zP6lco1PnnIu.bat

Path C:\Users\Admin\AppData\Local\Temp\zP6lco1PnnIu.bat
Size 185B
SHA256 a9b6193c1d5bc6428bbf36ffa36c7ca4fb40c97f8de2b8d39fd361448eea8aa3
MD5 81d2056559084f59c9dd39de329049f2
SHA1 c5c7434f7c4454867328ab4200f4c042aff73e58
SHA512 b1504c9d4988ba5ee0c40e8ad6c9de85b626656ae45710809aa15188ba9d3b989046660f97c4a09354cbc38ead0cc820f4202813718d9e47eff14685384d14a2
TLSH
T162C012015681CA6E45045C0A19AA668CF0A509996D497FA04605885C23D3C5CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

zzWhGp9NwNmh.bat

Path C:\Users\Admin\AppData\Local\Temp\zzWhGp9NwNmh.bat
Size 185B
SHA256 e36ae13a32344f5fe159281f0b9275ee1355d45e917b56b4280b675c5c44f112
MD5 8fa513331d8c177633898f5fdc3ab967
SHA1 0dc61a11bc1ddc16350ea51b9e059744a3384a74
SHA512 8480ee030b53ca603ca7d1808f1d02989f934867dff0922589e04964fad84e4198ef84dfb68a9dcbb2f954694780c88fd4c885a553883ad7d62203955931f0ba
TLSH
T12BC0120142868A5E4A045C5A5DE9768CF1A908AD69497FA04541885C27D3C99B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-99-0x0000000001240000-0x000000000124C000-memory.dmp

Download

memory/224-101-0x000000001BEC0000-0x000000001BF6F000-memory.dmp

Download

memory/224-100-0x0000000001260000-0x0000000001272000-memory.dmp

Download

memory/660-51-0x0000000002B70000-0x0000000002B82000-memory.dmp

Download

memory/660-52-0x000000001BFB0000-0x000000001C05F000-memory.dmp

Download

memory/660-50-0x0000000002B60000-0x0000000002B6C000-memory.dmp

Download

memory/1948-65-0x0000000002E40000-0x0000000002E52000-memory.dmp

Download

memory/1948-66-0x000000001C160000-0x000000001C20F000-memory.dmp

Download

memory/1948-64-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Download

memory/2152-87-0x000000001BFA0000-0x000000001C04F000-memory.dmp

Download

memory/2152-86-0x0000000001360000-0x0000000001372000-memory.dmp

Download

memory/2152-85-0x0000000001350000-0x000000000135C000-memory.dmp

Download

memory/2184-155-0x0000000003100000-0x000000000310C000-memory.dmp

Download

memory/2692-106-0x00000000018A0000-0x00000000018AC000-memory.dmp

Download

memory/2692-107-0x00000000018C0000-0x00000000018D2000-memory.dmp

Download

memory/2692-108-0x000000001C540000-0x000000001C5EF000-memory.dmp

Download

memory/2700-150-0x000000001BC50000-0x000000001BCFF000-memory.dmp

Download

memory/2700-149-0x0000000001150000-0x0000000001162000-memory.dmp

Download

memory/2700-148-0x0000000001140000-0x000000000114C000-memory.dmp

Download

memory/2736-22-0x0000000003010000-0x000000000301C000-memory.dmp

Download

memory/2736-23-0x0000000003020000-0x0000000003032000-memory.dmp

Download

memory/2736-24-0x000000001C360000-0x000000001C40F000-memory.dmp

Download

memory/3188-142-0x0000000000C20000-0x0000000000C32000-memory.dmp

Download

memory/3188-143-0x000000001BD10000-0x000000001BDBF000-memory.dmp

Download

memory/3188-141-0x0000000000C10000-0x0000000000C1C000-memory.dmp

Download

memory/3356-59-0x000000001BBF0000-0x000000001BC9F000-memory.dmp

Download

memory/3356-57-0x00000000027C0000-0x00000000027CC000-memory.dmp

Download

memory/3356-58-0x00000000027F0000-0x0000000002802000-memory.dmp

Download

memory/3428-94-0x000000001C560000-0x000000001C60F000-memory.dmp

Download

memory/3428-93-0x00000000015B0000-0x00000000015C2000-memory.dmp

Download

memory/3428-92-0x0000000001580000-0x000000000158C000-memory.dmp

Download

memory/3544-71-0x00000000017A0000-0x00000000017AC000-memory.dmp

Download

memory/3544-72-0x00000000018C0000-0x00000000018D2000-memory.dmp

Download

memory/3544-73-0x000000001C500000-0x000000001C5AF000-memory.dmp

Download

memory/4004-43-0x0000000002C60000-0x0000000002C6C000-memory.dmp

Download

memory/4004-45-0x000000001BF80000-0x000000001C02F000-memory.dmp

Download

memory/4004-44-0x0000000002C70000-0x0000000002C82000-memory.dmp

Download

memory/4252-120-0x0000000001480000-0x000000000148C000-memory.dmp

Download

memory/4252-121-0x0000000002D40000-0x0000000002D52000-memory.dmp

Download

memory/4252-122-0x000000001C240000-0x000000001C2EF000-memory.dmp

Download

memory/4480-79-0x00000000012E0000-0x00000000012F2000-memory.dmp

Download

memory/4480-78-0x00000000012D0000-0x00000000012DC000-memory.dmp

Download

memory/4480-80-0x000000001BFB0000-0x000000001C05F000-memory.dmp

Download

memory/4892-8-0x000000001BB00000-0x000000001BBAF000-memory.dmp

Download

memory/4892-1-0x0000000002B10000-0x0000000002B20000-memory.dmp

Download

memory/4892-0-0x00000000004A0000-0x00000000007CC000-memory.dmp

Download

memory/4892-6-0x00000000029A0000-0x00000000029AC000-memory.dmp

Download

memory/4892-7-0x0000000002AD0000-0x0000000002AE2000-memory.dmp

Download

memory/4960-135-0x00000000018D0000-0x00000000018E2000-memory.dmp

Download

memory/4960-134-0x00000000018B0000-0x00000000018BC000-memory.dmp

Download

memory/4960-136-0x000000001C4B0000-0x000000001C55F000-memory.dmp

Download

memory/5048-11-0x000000001AF80000-0x000000001AF90000-memory.dmp

Download

memory/5048-17-0x000000001B840000-0x000000001B8EF000-memory.dmp

Download

memory/5048-16-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Download

memory/5048-15-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

Download

memory/5108-114-0x00000000017F0000-0x0000000001802000-memory.dmp

Download

memory/5108-115-0x000000001C880000-0x000000001C92F000-memory.dmp

Download

memory/5108-113-0x00000000017E0000-0x00000000017EC000-memory.dmp

Download

memory/5276-127-0x0000000002E70000-0x0000000002E7C000-memory.dmp

Download

memory/5276-129-0x000000001C5A0000-0x000000001C64F000-memory.dmp

Download

memory/5276-128-0x0000000002E80000-0x0000000002E92000-memory.dmp

Download

memory/5668-37-0x00000000018F0000-0x0000000001902000-memory.dmp

Download

memory/5668-38-0x000000001C6A0000-0x000000001C74F000-memory.dmp

Download

memory/5668-36-0x00000000018E0000-0x00000000018EC000-memory.dmp

Download

memory/5812-30-0x0000000002890000-0x00000000028A2000-memory.dmp

Download

memory/5812-31-0x000000001BCC0000-0x000000001BD6F000-memory.dmp

Download

memory/5812-29-0x0000000002880000-0x000000000288C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads