quasar | 8689fdc42ce41065b5c5488b9837f9ea42ea57e22ebdbf6019f238d819a8bad8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260408-dr2bwaf15k
SHA256 8689fdc42ce41065b5c5488b9837f9ea42ea57e22ebdbf6019f238d819a8bad8
MD5 1cc184c4250aa39ffb046a9d62304489
SHA1 7cd0632473d1c301a9461c6ffdde50b3901ade22
SHA512 ae2a1fbb57d9d9534b0486c1d7db608321daf6acbb446097d502bbb41f40a92947ba34956b5b394d0fab19389f3e7d71d3ce5496d92f67b4094eb7fe4c50479a
SSDEEP 49152:ryhJJHPNCC7J98vBgJh99oG4znXrwxUuxGuTHHB72eh2NT:ryhrHPh7J98vGJh99tzx
TLSH
T11CE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilacxyf.tv
malware.xoilacxyf.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4128-0-0x0000000000480000-0x00000000007AC000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	messenger_update.exe
Token: SeDebugPrivilege	5100	messenger_update.exe
Token: SeDebugPrivilege	4504	messenger_update.exe
Token: SeDebugPrivilege	5912	messenger_update.exe
Token: SeDebugPrivilege	3756	messenger_update.exe
Token: SeDebugPrivilege	2196	messenger_update.exe
Token: SeDebugPrivilege	5780	messenger_update.exe
Token: SeDebugPrivilege	772	messenger_update.exe
Token: SeDebugPrivilege	5732	messenger_update.exe
Token: SeDebugPrivilege	1352	messenger_update.exe
Token: SeDebugPrivilege	2188	messenger_update.exe
Token: SeDebugPrivilege	1768	messenger_update.exe
Token: SeDebugPrivilege	1944	messenger_update.exe
Token: SeDebugPrivilege	1928	messenger_update.exe
Token: SeDebugPrivilege	5868	messenger_update.exe
Token: SeDebugPrivilege	2888	messenger_update.exe
Token: SeDebugPrivilege	3976	messenger_update.exe
Token: SeDebugPrivilege	1080	messenger_update.exe
Token: SeDebugPrivilege	5320	messenger_update.exe
Token: SeDebugPrivilege	5112	messenger_update.exe
Token: SeDebugPrivilege	3972	messenger_update.exe
Token: SeDebugPrivilege	4552	messenger_update.exe
Token: SeDebugPrivilege	740	messenger_update.exe
Token: SeDebugPrivilege	1356	messenger_update.exe
Token: SeDebugPrivilege	5172	messenger_update.exe
Token: SeDebugPrivilege	5148	messenger_update.exe
Token: SeDebugPrivilege	2192	messenger_update.exe
Token: SeDebugPrivilege	1188	messenger_update.exe
Token: SeDebugPrivilege	1984	messenger_update.exe
Token: SeDebugPrivilege	4960	messenger_update.exe
Token: SeDebugPrivilege	4768	messenger_update.exe
Token: SeDebugPrivilege	2908	messenger_update.exe
Token: SeDebugPrivilege	5532	messenger_update.exe
Token: SeDebugPrivilege	4296	messenger_update.exe
Token: SeDebugPrivilege	5812	messenger_update.exe
Token: SeDebugPrivilege	5304	messenger_update.exe
Token: SeDebugPrivilege	3252	messenger_update.exe
Token: SeDebugPrivilege	5144	messenger_update.exe
Token: SeDebugPrivilege	2648	messenger_update.exe
Token: SeDebugPrivilege	2592	messenger_update.exe
Token: SeDebugPrivilege	4748	messenger_update.exe
Token: SeDebugPrivilege	2308	messenger_update.exe
Token: SeDebugPrivilege	5876	messenger_update.exe
Token: SeDebugPrivilege	2208	messenger_update.exe
Token: SeDebugPrivilege	3856	messenger_update.exe
Token: SeDebugPrivilege	768	messenger_update.exe
Token: SeDebugPrivilege	4452	messenger_update.exe
Token: SeDebugPrivilege	5920	messenger_update.exe
Token: SeDebugPrivilege	2704	messenger_update.exe
Token: SeDebugPrivilege	4980	messenger_update.exe
Token: SeDebugPrivilege	1724	messenger_update.exe
Token: SeDebugPrivilege	3980	messenger_update.exe
Token: SeDebugPrivilege	5592	messenger_update.exe
Token: SeDebugPrivilege	1292	messenger_update.exe
Token: SeDebugPrivilege	5616	messenger_update.exe
Token: SeDebugPrivilege	4864	messenger_update.exe
Token: SeDebugPrivilege	1412	messenger_update.exe
Token: SeDebugPrivilege	5032	messenger_update.exe
Token: SeDebugPrivilege	2200	messenger_update.exe
Token: SeDebugPrivilege	1624	messenger_update.exe
Token: SeDebugPrivilege	2516	messenger_update.exe
Token: SeDebugPrivilege	5516	messenger_update.exe
Token: SeDebugPrivilege	3668	messenger_update.exe
Token: SeDebugPrivilege	5392	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1164	4128	messenger_update.exe	78
PID 1164 wrote to memory of 4188	1164	cmd.exe	80
PID 1164 wrote to memory of 5100	1164	cmd.exe	81
PID 5100 wrote to memory of 2612	5100	messenger_update.exe	82
PID 2612 wrote to memory of 4232	2612	cmd.exe	84
PID 2612 wrote to memory of 4504	2612	cmd.exe	85
PID 4504 wrote to memory of 5428	4504	messenger_update.exe	86
PID 5428 wrote to memory of 3372	5428	cmd.exe	88
PID 5428 wrote to memory of 5912	5428	cmd.exe	89
PID 5912 wrote to memory of 5224	5912	messenger_update.exe	90
PID 5224 wrote to memory of 740	5224	cmd.exe	92
PID 5224 wrote to memory of 3756	5224	cmd.exe	93
PID 3756 wrote to memory of 3160	3756	messenger_update.exe	94
PID 3160 wrote to memory of 5792	3160	cmd.exe	96
PID 3160 wrote to memory of 2196	3160	cmd.exe	97
PID 2196 wrote to memory of 3620	2196	messenger_update.exe	98
PID 3620 wrote to memory of 5972	3620	cmd.exe	100
PID 3620 wrote to memory of 5780	3620	cmd.exe	101
PID 5780 wrote to memory of 2224	5780	messenger_update.exe	102
PID 2224 wrote to memory of 3668	2224	cmd.exe	104
PID 2224 wrote to memory of 772	2224	cmd.exe	105
PID 772 wrote to memory of 5308	772	messenger_update.exe	106
PID 5308 wrote to memory of 1348	5308	cmd.exe	108
PID 5308 wrote to memory of 5732	5308	cmd.exe	109
PID 5732 wrote to memory of 5040	5732	messenger_update.exe	110
PID 5040 wrote to memory of 5372	5040	cmd.exe	112
PID 5040 wrote to memory of 1352	5040	cmd.exe	113
PID 1352 wrote to memory of 5644	1352	messenger_update.exe	114
PID 5644 wrote to memory of 5564	5644	cmd.exe	116
PID 5644 wrote to memory of 2188	5644	cmd.exe	117
PID 2188 wrote to memory of 5252	2188	messenger_update.exe	118
PID 5252 wrote to memory of 1448	5252	cmd.exe	120
PID 5252 wrote to memory of 1768	5252	cmd.exe	121
PID 1768 wrote to memory of 2976	1768	messenger_update.exe	122
PID 2976 wrote to memory of 4036	2976	cmd.exe	124
PID 2976 wrote to memory of 1944	2976	cmd.exe	125
PID 1944 wrote to memory of 1312	1944	messenger_update.exe	126
PID 1312 wrote to memory of 4980	1312	cmd.exe	128
PID 1312 wrote to memory of 1928	1312	cmd.exe	129
PID 1928 wrote to memory of 1708	1928	messenger_update.exe	130
PID 1708 wrote to memory of 892	1708	cmd.exe	132
PID 1708 wrote to memory of 5868	1708	cmd.exe	133
PID 5868 wrote to memory of 5560	5868	messenger_update.exe	134
PID 5560 wrote to memory of 3980	5560	cmd.exe	136
PID 5560 wrote to memory of 2888	5560	cmd.exe	137
PID 2888 wrote to memory of 1436	2888	messenger_update.exe	138
PID 1436 wrote to memory of 5484	1436	cmd.exe	140
PID 1436 wrote to memory of 3976	1436	cmd.exe	141
PID 3976 wrote to memory of 4884	3976	messenger_update.exe	142
PID 4884 wrote to memory of 5152	4884	cmd.exe	144
PID 4884 wrote to memory of 1080	4884	cmd.exe	145
PID 1080 wrote to memory of 3656	1080	messenger_update.exe	146
PID 3656 wrote to memory of 1508	3656	cmd.exe	148
PID 3656 wrote to memory of 5320	3656	cmd.exe	149
PID 5320 wrote to memory of 5728	5320	messenger_update.exe	150
PID 5728 wrote to memory of 4860	5728	cmd.exe	152
PID 5728 wrote to memory of 4520	5728	cmd.exe	153
PID 5128 wrote to memory of 1284	5128	cmd.exe	156
PID 5128 wrote to memory of 5112	5128	cmd.exe	157
PID 5112 wrote to memory of 4344	5112	messenger_update.exe	158
PID 4344 wrote to memory of 4920	4344	cmd.exe	160
PID 4344 wrote to memory of 3972	4344	cmd.exe	161
PID 3972 wrote to memory of 1128	3972	messenger_update.exe	162
PID 1128 wrote to memory of 4628	1128	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pdjx3bK0vlcq.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X7u4cPmaY6xi.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\T96lc9t6oL2m.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QnFAQ5KLhYQx.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3jGjT3Tib4xj.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3g4fHzYffMBd.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TKuF8hbka54G.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uhk4QwZ9ABGL.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:5308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BYQHktUzujUf.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AxFgugnbWijl.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IBPbJj8kMIhV.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3Fm3Q2unpUgk.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DzYYvIvtoSVO.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iOn9eNUnmlq6.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ApO1aGrmOTwL.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\etLvN0nVz3St.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6vhTuaKOp1TG.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hRVxK6R0iVOW.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tR0azuA4f8Rt.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UTAp2IeGuwCB.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PIuw5NsprjS0.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z7HSrhBSPSrD.bat" "
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FZ1KJMGftxfP.bat" "
        46⤵
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IWp56ITUdOG6.bat" "
        48⤵
        
        PID:560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygeTx8v2Vmee.bat" "
        50⤵
        
        PID:2792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ayFP7wrOJwzU.bat" "
        52⤵
        
        PID:4172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bhGnyiiTz9Gf.bat" "
        54⤵
        
        PID:4248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mouIx0cQaG0m.bat" "
        56⤵
        
        PID:4964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1BL3a0nP1nxV.bat" "
        58⤵
        
        PID:5168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egaVTLlLh3l7.bat" "
        60⤵
        
        PID:992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7fAvWHs2NKDJ.bat" "
        62⤵
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y0Ma0LEnmybP.bat" "
        64⤵
        
        PID:5020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WPPTC8tomZv0.bat" "
        66⤵
        
        PID:4712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JjyN7kyr0Eet.bat" "
        68⤵
        
        PID:3600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z2jgmNknkmDO.bat" "
        70⤵
        
        PID:4612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qhcbjm8IqU4g.bat" "
        72⤵
        
        PID:3944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEGys5HrTfWl.bat" "
        74⤵
        
        PID:1640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1x1s9iLbckhy.bat" "
        76⤵
        
        PID:4432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YTfKlMllKPke.bat" "
        78⤵
        
        PID:5060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        79⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ziaE9HJDA66E.bat" "
        80⤵
        
        PID:3428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        81⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\voCurpdUnwT7.bat" "
        82⤵
        
        PID:5196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        83⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYpry1Lc1z2x.bat" "
        84⤵
        
        PID:2396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        85⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uhJILjvsks2E.bat" "
        86⤵
        
        PID:3556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        87⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exE1KQEJ0PBM.bat" "
        88⤵
        
        PID:2212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        89⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\V7db0OJhKOUl.bat" "
        90⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        91⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKwPTqUU4GfI.bat" "
        92⤵
        
        PID:3764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        93⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dBeQLjSPF5mR.bat" "
        94⤵
        
        PID:3908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        95⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XrYDjxZdLrvf.bat" "
        96⤵
        
        PID:4304
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        97⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lXUp4lFqAlpO.bat" "
        98⤵
        
        PID:2152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        99⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EG1LvWgbxlkZ.bat" "
        100⤵
        
        PID:4364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        101⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a9AGc1XPOeOO.bat" "
        102⤵
        
        PID:5256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        103⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIOVQQRcLQxN.bat" "
        104⤵
        
        PID:3112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        105⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aWbwTkUw2OLO.bat" "
        106⤵
        
        PID:960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        107⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LL9VxJ8D2J3p.bat" "
        108⤵
        
        PID:1592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        109⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XvYhYk08NP0N.bat" "
        110⤵
        
        PID:3172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        111⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AWf03jgMy6Ze.bat" "
        112⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        113⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCqHJwMNnT0p.bat" "
        114⤵
        
        PID:4620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        115⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMGoaeIsW54Y.bat" "
        116⤵
        
        PID:2428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        117⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YLGmmE0mkhM2.bat" "
        118⤵
        
        PID:6076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        119⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CDDGt2NqAoNV.bat" "
        120⤵
        
        PID:2556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        121⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKLxtDH7TKzO.bat" "
        122⤵
        
        PID:1132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        123⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ervDVkCWeirw.bat" "
        124⤵
        
        PID:4340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        125⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q5qTnxYn3qRB.bat" "
        126⤵
        
        PID:5676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        127⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DGlqGgqenvS4.bat" "
        128⤵
        
        PID:4972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        129⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        129⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qso6rd46OjiZ.bat" "
        130⤵
        
        PID:568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        131⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        131⤵
        
        PID:5264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sH4YJuMMmJC4.bat" "
        132⤵
        
        PID:4436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        133⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        133⤵
        
        PID:2072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FNzAq96Ecl2K.bat" "
        134⤵
        
        PID:2204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        135⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        135⤵
        
        PID:5948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAzxdWvrHya7.bat" "
        136⤵
        
        PID:2280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        137⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        137⤵
        
        PID:2584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S7WYOQBeDe6P.bat" "
        138⤵
        
        PID:5596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        139⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        139⤵
        
        PID:1908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\19ouIptrx77K.bat" "
        140⤵
        
        PID:2268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        141⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        141⤵
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uwXfsWqmPPEz.bat" "
        142⤵
        
        PID:3236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        143⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        143⤵
        
        PID:1488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGvCfRHegmsB.bat" "
        144⤵
        
        PID:5288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        145⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        145⤵
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lITW38lckjtO.bat" "
        146⤵
        
        PID:1508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        147⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        147⤵
        
        PID:5368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OJqsLapsYXLc.bat" "
        148⤵
        
        PID:4868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        149⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        149⤵
        
        PID:72
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hLVXrOUKUftK.bat" "
        150⤵
        
        PID:4848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        151⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        151⤵
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8ZoiwmPUSlrP.bat" "
        152⤵
        
        PID:4236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        153⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        153⤵
        
        PID:5104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L9FplQaneMZy.bat" "
        154⤵
        
        PID:4260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        155⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        155⤵
        
        PID:2736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Eu5Zq7Ow6wCs.bat" "
        156⤵
        
        PID:5916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        157⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        157⤵
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGfqsb7jINMg.bat" "
        158⤵
        
        PID:3820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        159⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        159⤵
        
        PID:896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\86tWGEUKhdT9.bat" "
        160⤵
        
        PID:5972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        161⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        161⤵
        
        PID:5160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQAqEBRIoDTD.bat" "
        162⤵
        
        PID:2472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        163⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        163⤵
        
        PID:5884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72Rs06U2j0K7.bat" "
        164⤵
        
        PID:5632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        165⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        165⤵
        
        PID:4576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DViKzarq49Fv.bat" "
        166⤵
        
        PID:5624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        167⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        167⤵
        
        PID:5364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pa9yAyYfN4Ko.bat" "
        168⤵
        
        PID:5388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        169⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        169⤵
        
        PID:5420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WG0BjVEUBCSr.bat" "
        170⤵
        
        PID:1276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        171⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        171⤵
        
        PID:4408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgbMjqp0hfmt.bat" "
        172⤵
        
        PID:5960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        173⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        173⤵
        
        PID:464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msHw6aEkQFJW.bat" "
        174⤵
        
        PID:4588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        175⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        175⤵
        
        PID:868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gID2TlF3Qhxu.bat" "
        176⤵
        
        PID:224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        177⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        177⤵
        
        PID:2668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7djzP4tDbhrW.bat" "
        178⤵
        
        PID:2080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        179⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        179⤵
        
        PID:5468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\es5abEvNoD0B.bat" "
        180⤵
        
        PID:1696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        181⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        181⤵
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b1Ieo1Vfv6NI.bat" "
        182⤵
        
        PID:2956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        183⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        183⤵
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wsNzCEzKfzsQ.bat" "
        184⤵
        
        PID:3552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        185⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        185⤵
        
        PID:1868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z9FYBBqgn4Yi.bat" "
        186⤵
        
        PID:4916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        187⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        187⤵
        
        PID:1460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sc2OfpOF33sD.bat" "
        188⤵
        
        PID:3560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        189⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        189⤵
        
        PID:3000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h1g1dhNHudt7.bat" "
        190⤵
        
        PID:3612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        191⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        191⤵
        
        PID:5932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p9wlJ2Za8Nu7.bat" "
        192⤵
        
        PID:3952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        193⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        193⤵
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OVVq0cxsl1np.bat" "
        194⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        195⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        195⤵
        
        PID:2040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xTfXWepIcGgu.bat" "
        196⤵
        
        PID:1300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        197⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        197⤵
        
        PID:3268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eZ477Dp8z34i.bat" "
        198⤵
        
        PID:5860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        199⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        199⤵
        
        PID:804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D9pjsVyeY875.bat" "
        200⤵
        
        PID:4668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        201⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        201⤵
        
        PID:3288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ggVs6Ru3hlHJ.bat" "
        202⤵
        
        PID:3444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        203⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        203⤵
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O1YDWd5okJdC.bat" "
        204⤵
        
        PID:1068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        205⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        205⤵
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lr6ToSTlfDBo.bat" "
        206⤵
        
        PID:112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        207⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        207⤵
        
        PID:4464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PRQgQTmCdNqG.bat" "
        208⤵
        
        PID:2276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        209⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        209⤵
        
        PID:5804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sl7UCL1MU5Ap.bat" "
        210⤵
        
        PID:5512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        211⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        211⤵
        
        PID:4468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8BQzoJxPChrq.bat" "
        212⤵
        
        PID:2740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        213⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        213⤵
        
        PID:412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aOPr7SrKmRRp.bat" "
        214⤵
        
        PID:2728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        215⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        215⤵
        
        PID:4828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCM3uoH1CHHr.bat" "
        216⤵
        
        PID:4716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        217⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        217⤵
        
        PID:5720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QFeQ7jhdGElD.bat" "
        218⤵
        
        PID:5084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        219⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        219⤵
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2FEqnzjuEmZ.bat" "
        220⤵
        
        PID:1552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        221⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        221⤵
        
        PID:5796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I7JUD0Mf92OP.bat" "
        222⤵
        
        PID:3200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        223⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        223⤵
        
        PID:4872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EWNtt5lAjZQm.bat" "
        224⤵
        
        PID:3960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        225⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        225⤵
        
        PID:2420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NFaweG9gcOgw.bat" "
        226⤵
        
        PID:888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        227⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        227⤵
        
        PID:5684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nGvjbT3eknNu.bat" "
        228⤵
        
        PID:4324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        229⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        229⤵
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9Qhojb8HCuYH.bat" "
        230⤵
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        231⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        231⤵
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEYUMSETd0gb.bat" "
        232⤵
        
        PID:5944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        233⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        233⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YvwSpUgtJMuV.bat" "
        234⤵
        
        PID:840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        235⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        235⤵
        
        PID:4284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2LV7szXs42g7.bat" "
        236⤵
        
        PID:5688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        237⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        237⤵
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NxIIE4Mq8ibk.bat" "
        238⤵
        
        PID:2780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        239⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        239⤵
        
        PID:584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOErQayfunOG.bat" "
        240⤵
        
        PID:5788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        241⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        241⤵
        
        PID:4632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O5AQxA0kFBWs.bat" "
        242⤵
        
        PID:3644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        243⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        243⤵
        
        PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

1BL3a0nP1nxV.bat

Path C:\Users\Admin\AppData\Local\Temp\1BL3a0nP1nxV.bat
Size 185B
SHA256 4461ec72971791d01c9f389729373d98ce0a3607c5acb41c2266f4dac78b577b
MD5 148f8dac4b9edfc4ffce25673a065b1c
SHA1 4db63aa4f752c55646a8cb9cb4ae76af7b08154b
SHA512 e596cf304ec9cdfd4cf9c2e69ba9373468607db3c63d20fd9a4a40975ba708a0629e545bb79ef63617378006a3a7e85d29c01d3de5e1c8b122e0792e6af1ef4f
TLSH
T154C0120251818A5E55145C0A19A977CCF099089D29497FA14501885D27D2CA8B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

1x1s9iLbckhy.bat

Path C:\Users\Admin\AppData\Local\Temp\1x1s9iLbckhy.bat
Size 185B
SHA256 162c0a3d9ba15f5f591dcf80335dd71ec65bae451d344aac7e2430ad033c2c31
MD5 6777db35d4f70558f8f78b843f5f4833
SHA1 3bac8eeae662040d9112bd225ea5f8c300e1c697
SHA512 efd8f60d9e5c266d550de6495f742b542ba422b7505b0e0046c3acbd95a4f32552b391970664f84c9156653870d0daf1eae72cb64c576f45b577b2f4c1ef8707
TLSH
T132C0120155818A5E45046C0B19E9768CF0A508996E49BFA48915885C13D7C58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

3Fm3Q2unpUgk.bat

Path C:\Users\Admin\AppData\Local\Temp\3Fm3Q2unpUgk.bat
Size 185B
SHA256 7718a616dfe6a36d48a597c468782520a9c95aa038852451e26f79dc01304074
MD5 1e1f317637450b086548235e3e797e8f
SHA1 34e5476e77cea3f0e7c298d022dcc0c15e0466d6
SHA512 5fc0f9c215fbd8ac761c12ebb3fe72b6919e53877f7d516707a1a7d1fe5c9867171e892848ab91798546a89a4ea634270bfb15e99f873c8626a4811ec547055b
TLSH
T122C0120142828A6E55046D1A29EA768CF0D5099D2949BFA14501889D53D7C58B5CB786
MD5 SHA1 SHA512 TLSH

Submit Download

3g4fHzYffMBd.bat

Path C:\Users\Admin\AppData\Local\Temp\3g4fHzYffMBd.bat
Size 185B
SHA256 209c36c373937c607714c8daf092062896f3ce72eb1e3715566fe752e9983bb6
MD5 4d9e9a27470b30e7048012f1103ccc15
SHA1 7680c186041cd3fdc95b58de8542756f0e251f37
SHA512 77ee641fa1468dcb32fa787fea57708c622d0edb30cb23799c97612571baa95926c84616906a2a61ff4e0f780a82a822c7ee8fe7287e897f03874b5d06dcbc9b
TLSH
T1D8C0120142828A6E45146C0A59A96ACCF1D6089D69497FA045018C9C57D2C68B9DB783
MD5 SHA1 SHA512 TLSH

Submit Download

3jGjT3Tib4xj.bat

Path C:\Users\Admin\AppData\Local\Temp\3jGjT3Tib4xj.bat
Size 185B
SHA256 58a0c1f5f0deee94be5a6b4441af2ddd467d1a3dee16375f2781409b0e002f92
MD5 a96c590ea134e5b034c7c4508b9c754b
SHA1 8047bdb6e61b063f7cf00f12fe3da2698afced22
SHA512 80b48e80444357ec627f32b524368089e616434cee9d0cd24f2b4f64e344c464d36d566c8aa643b65d49b31b680de2dcc9ce68eb5a23dd15b120dbb3a1979e2e
TLSH
T113C012014282CA6E49049D0B19A9768CF0D5089D29497FA44981C85C13D2C5CB9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

6vhTuaKOp1TG.bat

Path C:\Users\Admin\AppData\Local\Temp\6vhTuaKOp1TG.bat
Size 185B
SHA256 f1f07a64bb094f5d036ee72f01120b1cff0404972141e61be74d14ba054fe358
MD5 8886e21354ffde7c8bdf9a79e6b3f371
SHA1 c62a10f46acab1d1852714425bb5e3cfd51e5bab
SHA512 bd63da85d47824f5b81905939b9d322a9c98cdbe9fec75e6b4c3a30122a82a0d3b7466647b0e1a5d06cff169bf24a582a99ea53e3b5b5c8d1174f6f78a452e4d
TLSH
T19BC012015286CA5E46045C0A19EA668CF096099929497FA44922CC5C13D3C58F9DB7C6
MD5 SHA1 SHA512 TLSH

Submit Download

7fAvWHs2NKDJ.bat

Path C:\Users\Admin\AppData\Local\Temp\7fAvWHs2NKDJ.bat
Size 185B
SHA256 6065fdf2387fae44c6f42f628314f4aa9b0fb1706892ecb754ba0310dcbaf344
MD5 0b46bf30ed5a5e8427484e9dd3a243b6
SHA1 ce448e38839967e33ebb4f9d8a165275efecb867
SHA512 5f92a3eaa15d8275d3513003cb8b7c42339309fc417628aee1cfa320ae174dab98fccd9ce865ed41a58d6f15c0b08cd98479e4db8b6f1bec9b57dd73701b9861
TLSH
T170C012014281CA9E45145C0A19A9A6CCF09608996D497FA045118C5D63D2C5DB5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

AWf03jgMy6Ze.bat

Path C:\Users\Admin\AppData\Local\Temp\AWf03jgMy6Ze.bat
Size 185B
SHA256 c33059332e47b6d8ca0796ae4d18f078b385bd96881638075e69cc08683edca6
MD5 0d4de2e25f745bb004b20e1de29494c3
SHA1 b3b223d339a41f7708d55b0fd7bbb55c4152102b
SHA512 6570dd7e0487dfef60be82d392b1bcf27a01e7a07fe2d7d2204150b21c9b1c7eeb439acf1f0e126e8a64a18124338128526548e62a02aab391bf42b122ca5bc7
TLSH
T16CC0220181818A1E45040C0A08EA73CCF09508983A487FA085018C4C13D2C58B9CF382
MD5 SHA1 SHA512 TLSH

Submit Download

ApO1aGrmOTwL.bat

Path C:\Users\Admin\AppData\Local\Temp\ApO1aGrmOTwL.bat
Size 185B
SHA256 3e47264dac5d51ac54e881d1161d47c586d319f27468fa5a1916285ace6e4ac7
MD5 5cd7733cb68b3c045db34ec8461b2aa9
SHA1 4b33cdc63deeee791165c56c7aacd0fe9a4b284e
SHA512 334770a20010aa2ad2cb989e85d7d3d753361aa966f4f63b590651dc712d2720ebd89887df395c14ebaefb2347bf05c28d09d59533d2dc05b6a6a27dee2be58a
TLSH
T1EFC0120153918A5E49085C0A19B9B7CCF096089D2949BFA04911885C57D2C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

AxFgugnbWijl.bat

Path C:\Users\Admin\AppData\Local\Temp\AxFgugnbWijl.bat
Size 185B
SHA256 e0a52c3c73154edc05e43c7b0babb17fd62a4a8286bc7a29d8f620ecbc33c1ba
MD5 d6d6b7a8ed312eab4745fe6b69802f82
SHA1 78eb7811a9e25ff137bc732e48840290308e7fd5
SHA512 a3b64d5cbe7de06e98b0ac8f4688b46c0239391dbc8f7a815edc3b6771bbf4817ad9b7330ed091a869ed835b711ccef3719a03d27457a6b64d79e54d4d6253ea
TLSH
T144C0120185C1CA5E55085C0A59A967CDF095089D2A497FA04502885D13D3C58B5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

BYQHktUzujUf.bat

Path C:\Users\Admin\AppData\Local\Temp\BYQHktUzujUf.bat
Size 185B
SHA256 05781eac5b9f0c6d2734c400c6e8288642a409711c28f03858d72477437ec1ed
MD5 dccd9c72fe88adbca6179e764dce21ba
SHA1 34a1f243a5416bd755a7d4dcc9dc4a8768bb53c1
SHA512 92264d1aadca94d43c02a78e0fbf7df230446f550bf71b6c27056a45fcca008bfa05e42c22794691789dda316711e93f07863540e50ff76052aaa3c8c5c2f4f6
TLSH
T1F3C0121145818A6E86145C1B19A9B78CF19909A92A497FB04541885C17D2C58B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

CDDGt2NqAoNV.bat

Path C:\Users\Admin\AppData\Local\Temp\CDDGt2NqAoNV.bat
Size 185B
SHA256 e7f1c9ec37ea1d346923087bb523216418f5710843a283d7ed7e480a9bc25417
MD5 6d7c992e239647af3cf949d5bfa7533a
SHA1 d351922766ae736e5d8e38559b1fb5c88957ae45
SHA512 76f60e7eec9976689b0129a3861a0a43d2e09e8ed391b972eabc7033f87b86fe90c88881ddad30f428fdb20cce798794098a97feca35fac4ae88cb305328d904
TLSH
T10DC0120191818A5E46145C0B29E9A7CCF09908A93A497FA145418C5D13D6C68B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

DGlqGgqenvS4.bat

Path C:\Users\Admin\AppData\Local\Temp\DGlqGgqenvS4.bat
Size 185B
SHA256 852841317090ba6496a5d833b4b976bae80ac085d6bf9970ebda875272d5cb87
MD5 a71954de394e9375958b6bc761549533
SHA1 ee8f80864a73b61869559a90d8d4fb51cd885791
SHA512 4555c6403bb580006ee8efa1231fe56e03ae6d6a440a85340cddc38de13b5bd88bd2a6f29b5110d1db08c312c86845f4c5716785e2b1141775d324584a3c0cd8
TLSH
T167C012014185CA6E45045C0A59E9778CF09508992D897FA549018C5D63D2C69B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

DzYYvIvtoSVO.bat

Path C:\Users\Admin\AppData\Local\Temp\DzYYvIvtoSVO.bat
Size 185B
SHA256 44e8f2cf25852c8b87e9d0f773e9d74b9d3ebcaf665bc3c65d4c29e972a9f50a
MD5 a45f4ff47001824aa827f410a6bb1163
SHA1 d452da1ae1d3d2c85d0713c78c8c27200764444f
SHA512 fe27393f1478f8f82a51f51a09600f021b1ddac625bf979b857b650c8be8ee233e99864cb76843574d1890b43d56cf618fc8c3ca3bdcd5d9781dbc429c427e39
TLSH
T1E3C0120151818A5F45046C0B59EA768CF1D90CAD2A497FA54541885C93D2C9CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

EG1LvWgbxlkZ.bat

Path C:\Users\Admin\AppData\Local\Temp\EG1LvWgbxlkZ.bat
Size 185B
SHA256 8c7e53d7821341cab5fbd1cf23e527f1aac07e03a3b3165bed160e56123b2871
MD5 dee27c6192f764f4f7814a88a205b1e5
SHA1 7f18d42dfd8913790a1ed6bdee32097b93aabe93
SHA512 bb922aac0d7b763bbd24eaf569407a13ec839bbe9541b935b9c0b4b449ab81caedddb81d4d490321ca9110e64dbc29407106b98e3d830edeeaa26023e191d30b
TLSH
T17DC0120141C18A6E45045C0A59A9678CF0E50999294D7FA04A11885D53D3C58B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

FZ1KJMGftxfP.bat

Path C:\Users\Admin\AppData\Local\Temp\FZ1KJMGftxfP.bat
Size 185B
SHA256 6907498dce431196f9101c0e0143fc65a93ad000ab5291ee88a4812d5c390699
MD5 45099bdb4e75f442343b7e04827ca729
SHA1 a8f977f29ebf4e869f859d54213e4880dea18002
SHA512 c4196229f3be821b82bc4e33c1a2e71b45bf26895688f36e450e1d5bfb9422397950a1b284a3ff9832102b6e8edc6db8f6bd97e3c37e79368a07e7b2a4fd312c
TLSH
T177C0120155928A5E46045C0A2DE9768CF0A50C9969497FA046018C5C67D6C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

IBPbJj8kMIhV.bat

Path C:\Users\Admin\AppData\Local\Temp\IBPbJj8kMIhV.bat
Size 185B
SHA256 a4351d4ed4b963a267a71a948a4cc296cba739910b2f787ea2859b3940118948
MD5 889bb0fdbda3422646b043d681c31434
SHA1 b85f35b6b1b946e8e5ca04dd37daa39a548b244f
SHA512 490673f7b4bb4ae13f1316544e15d5b36036a2bb98a16dc4d6d9064d0bed6bc213424c6405509f74568c9fb8dd5ddaee30b35e6b343b130b62b8a978f8a99e99
TLSH
T1F6C0120142928A5E45145C0B59A9B68DF0D50C9D2949BFA14601885D53D6C6CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

IWp56ITUdOG6.bat

Path C:\Users\Admin\AppData\Local\Temp\IWp56ITUdOG6.bat
Size 185B
SHA256 11564430c86e58e8f5f60a7f53d65815316fb4fa1aa27d839b64f2c2e5232fca
MD5 655626f6aa60e6e3dfb5b5670877b587
SHA1 87d933ddae98a6dd9aad679c1fc2c1e6df718262
SHA512 9577fa31d2c5b57d85f5d872a7f7e7c465b5b3a11c8c6a17840f7bcf48c9b360622f79a9fefa05c010eaf15e6cb11eabbb89463b5ae9ddaf0833eabf6c561a56
TLSH
T100C012014191CA5E55045C1A59AAA68DF095089929497FA04A01CC5C13D7D99B9DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

JjyN7kyr0Eet.bat

Path C:\Users\Admin\AppData\Local\Temp\JjyN7kyr0Eet.bat
Size 185B
SHA256 81fbebcea918a89675c22dba901d0ec8bc639e5ba49406b34af5cc50d39eb907
MD5 3c1ea082a372207d9339b3fd5b782856
SHA1 b527fce19213919313bf900199af87abf77393f1
SHA512 e2454c9629ba24669541848daeefccae6b6270bc9af0af706ec5827fe3eebd3ca95acc15ab9180c7d448723b7f04773443721b9cde9890fd4bd5feeddb164fc8
TLSH
T127C0220081818A1E05000C0A08B966CCF195089829097FA00500CC4C13D2C58B4CB3D2
MD5 SHA1 SHA512 TLSH

Submit Download

LL9VxJ8D2J3p.bat

Path C:\Users\Admin\AppData\Local\Temp\LL9VxJ8D2J3p.bat
Size 185B
SHA256 7be679f0534778fbe926f4ade81332bd3ceaef21874374a1f5f35f74c928010a
MD5 943b9ccb5cf09d8aec975b33dfbb0f5f
SHA1 f16ffa97df3236e46d042c4f81f03d4440da1753
SHA512 e7e076fb7ecf916fdbe78d32c5b5b5bc18430ab715f5f40c5213d719069a7a4e4d7b0a4f034cdc7079484d2193011a036224016206f8063b97c1f3184fa6a2b4
TLSH
T1B7C0120145828A5F55045C0A59E966CCF0950C992A497FA04A41885C53D2C69B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

PIuw5NsprjS0.bat

Path C:\Users\Admin\AppData\Local\Temp\PIuw5NsprjS0.bat
Size 185B
SHA256 b30b620e1f9011eef5e35da9b881cd8bc48e12bfb36c99e3d0cf34594310cae7
MD5 136562542d7bb3c4d4eaa723e91ed422
SHA1 e2df6f0765d3e2fc8c35fcc7a4fa007af4c54cea
SHA512 439966182cb7bb1143666045a54af5161731cb0b077080d75b83d24b96855901fdeb329de55258ff24322642d0805364a6f3be5cbf2c2f111f90409ff84f7821
TLSH
T16BC012014582CA5E59045C0A59A9768CF09609992949BFA145118C5C23D6C58B5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

Pdjx3bK0vlcq.bat

Path C:\Users\Admin\AppData\Local\Temp\Pdjx3bK0vlcq.bat
Size 185B
SHA256 a394e2621335a6d1fe7c429233f9779cb5d02bcf2706026c730fce8508e12226
MD5 29d1d0eaa4a5ce9cf93971550727042b
SHA1 0c3b77a875242cad4fd33195095f359ce32e2655
SHA512 050901fe145e1de613d9a2cce33c60a5da3f3a1130c93fb3a1792851b3aa40ab456a6fccaf31f98ae9e97aeed9b1dc101938c806f5002e87bc907ada38c371c0
TLSH
T10EC0120151928A5E45045C1A1DA9A68CF095099D6949BFA58541889C27D6C5CB5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

Q5qTnxYn3qRB.bat

Path C:\Users\Admin\AppData\Local\Temp\Q5qTnxYn3qRB.bat
Size 185B
SHA256 b1c56897290cfc5affaf3342a8c43df6bdbc724e66388919583ef5b41b19c592
MD5 38149a0d64dac324005ac8f39abf7663
SHA1 e0e8d2863f761cc732e1bfbd1c8c3a7398db24d7
SHA512 81f377ff664a079ecb7f090982d933eb243215ed048035098a7f97cf427901baca67d246e59bc7bbc8894ba3c6961e14a221ef8d99bdfcc392c1fe2836913b40
TLSH
T1E9C022004182CA2E0A001C0A08AD768CF195089C2A087FA006028C8C23C2C68B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

Qhcbjm8IqU4g.bat

Path C:\Users\Admin\AppData\Local\Temp\Qhcbjm8IqU4g.bat
Size 185B
SHA256 65a142aef0a173b5863522a9c84f83657e4816d63a096a533650365eaa94ff6a
MD5 5bcf59d46e4156c7b506f898a48284a4
SHA1 b214106cdbfa515f3020e0ecc4045308ca6fcdba
SHA512 1fb3cb0cfdb4f9d35acc1d9dc314661060ca2f5d2c449b70eb25128d1b46ee7a4a9a7f89efe9118e3028ab1c647983f757302b872578323893d7f1b127e86a7e
TLSH
T1E9C012024591CA6E4A045C1B19AA768CF1A508A929497FA44501C85C13D2CA9B9CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

QnFAQ5KLhYQx.bat

Path C:\Users\Admin\AppData\Local\Temp\QnFAQ5KLhYQx.bat
Size 185B
SHA256 d78d2decbab660f5351cba5db5a84acb6093b3683c624040ff45c7f414626989
MD5 36a49eb9e2a201ad564c9ca69291d0c3
SHA1 3d63b43746910363b1cfd4d2561a82dc84aea746
SHA512 247dfeb3f4c313047c5ccf9ab15a7a15186f92463bb73817c24e6c0624cc7c2e2558a552960fb6d3e224e7dbbc7dc282098968b7db438c80a8a89c8e15f82936
TLSH
T1A7C0120181918A5E5A045C1B19AD76CCF09508996A497FA449018C5C23D2D59B5CB786
MD5 SHA1 SHA512 TLSH

Submit Download

T96lc9t6oL2m.bat

Path C:\Users\Admin\AppData\Local\Temp\T96lc9t6oL2m.bat
Size 185B
SHA256 8bd30e48c50f0610fd38f2140fa93f6ba5726c33fcd713f928f593385ce5a44d
MD5 174d03e238d04a526492742b45005a0e
SHA1 d226bd15f37fb5718ae8abdc995dbaa525e7c1c8
SHA512 3309a7be7855bc2d9848b836668bcebb06e46bfae30c9ce09c0c18330708858de29dae978d70271e559cb90a934afc386b466601ac6724650afb463eb2a48081
TLSH
T1E0C0121142958A5E5A045D0B19A9A68CF0DA089969497FA149818C5C13D2C58B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

TKuF8hbka54G.bat

Path C:\Users\Admin\AppData\Local\Temp\TKuF8hbka54G.bat
Size 185B
SHA256 180464185ab507e2f402392aa141457bd41d5ea4a5b0a2e98ebf21f0e2dc8cc1
MD5 460c0740bd27372cabf28b12eec173ae
SHA1 d286d63ee9de23a8524c0c52e8737df67adb225b
SHA512 6665eb1cad39b083067a7ab57f29b98abb445c9f35f997b69b9a1aedf55488f0dbc6f929e1a459f8324cd7e5130880228af40c576cb1c7648fe18a630d2e27d4
TLSH
T1F5C0120151828A6E45085C0A19A9A78CF0D909A92D497FA44A01885D67D2C58B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

TMGoaeIsW54Y.bat

Path C:\Users\Admin\AppData\Local\Temp\TMGoaeIsW54Y.bat
Size 185B
SHA256 f2e207e414ca8de22101e34dfb540cbb8b16925d74876d2b813c090978ec651a
MD5 77a40411a17cc1e7c5b8d71556244c34
SHA1 ad4b2f4d20035e8af34222aa99231f285c759332
SHA512 66a1ab9626f2bcd7ec858503455fff54b42f7e8244107c5270b45b5ad1cc0e12e94fc82dd4d0f39f20e130b063537b33284ebd462e6483d9915a92d82e987a13
TLSH
T153C0120155858A5E4A045C1B19E9A68CF0EA09A92D497FE04901885C57D2CA9B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

V7db0OJhKOUl.bat

Path C:\Users\Admin\AppData\Local\Temp\V7db0OJhKOUl.bat
Size 185B
SHA256 dd5fa5505bae03c5346e2b59028a9b5b2c836312673896852f0268407796640f
MD5 272e886fca6e63a188c995cce787f152
SHA1 1d0fda103118f31603359cb1a27f9f79037bc5bb
SHA512 7edeb0541f9d341b3e6d78b7a22ea5ae8064a7a1a57ec50c101d0bce2ed1d6051c7152c807ad232ff807573c14998ba259431ba6ac54443255e194284d477f71
TLSH
T182C0120145928A5E45445C0B29A9668DF1A509AD298A7FA04511885C23D3C58B9DF782
MD5 SHA1 SHA512 TLSH

Submit Download

WPPTC8tomZv0.bat

Path C:\Users\Admin\AppData\Local\Temp\WPPTC8tomZv0.bat
Size 185B
SHA256 316ae30eb07dc1d6e9666590e9d237dcfc031dd4ff32bce942ee185fe4cb7f80
MD5 4d0e92ad6f9dac32beb8a9b84cbf9765
SHA1 7dd5f555df6398693c9164d746180a6c7d17e7ec
SHA512 aadf083be578dd74b57886927a79572043ce1e6b23555ed2ac8e6646d89982bc0083adbe6e1ed30abf0605dff2b7a9c1d0201cb57f8f05e3e4ef62c713008123
TLSH
T197C0120186918A5F49045C0A19A9768CF0E5089929497FA14501885C23D7D58B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

X7u4cPmaY6xi.bat

Path C:\Users\Admin\AppData\Local\Temp\X7u4cPmaY6xi.bat
Size 185B
SHA256 a79df0ab7d896d0ecfa8575289846e77be00b2b668227a3710265c36d43822cb
MD5 0f8466e009d61fb6c07d069f9077f732
SHA1 e2cd97608a957830ea6ad94ff4442b75ec03b474
SHA512 a213f80f1a0cf8ec8fc4d7b506a0b55bd08540737f9b0e6c164a1e4da6ec8e1e46519e7452c6d3e6f12af44570058f3341021ed98a1e66cf30ea333087a3ece2
TLSH
T106C0120151928E5E49085C0B19A967CCF0E909A92A897FA54901889D23D7C68B9CB783
MD5 SHA1 SHA512 TLSH

Submit Download

XrYDjxZdLrvf.bat

Path C:\Users\Admin\AppData\Local\Temp\XrYDjxZdLrvf.bat
Size 185B
SHA256 5a43b0cb833ad529b92ad2f78fdd9cd49319dd03ca236acef1bbefd470e8241d
MD5 e5ff3565622ce8f6ac69ee0f3aa59597
SHA1 1cbc17316da23cf914995a2d541d66ba8661d2fb
SHA512 58a0f53f1e054728911ba814bf171dcebc3f4a19c0da5c12d4f03f732947467f8a9631635cf27926b54e408df00640bea8178c43f4cf2e06e9f920fcba7c0e4f
TLSH
T10BC012015181CA6E45145C0A19A9668CF09509AD2D49BFA445418C5C13D7C59B9DF782
MD5 SHA1 SHA512 TLSH

Submit Download

XvYhYk08NP0N.bat

Path C:\Users\Admin\AppData\Local\Temp\XvYhYk08NP0N.bat
Size 185B
SHA256 94f991d3c52b0a6cb2fa4a2d421b320571fbc59fe5035f40aa2971ca92654a24
MD5 68d47286637d3da9db7df687fcb03e54
SHA1 824508d5047d9c56cffb93879c0330b854fe0219
SHA512 867d7bbcab93305c0e889f0bfed21eed4bf0db50f8240516e5073288cb4adac3f694047d298177d9d78489fc7ce83e32893ce6e0d703eb522b283fd874c84406
TLSH
T199C0220092818A2E09045C0A49AAA68CF0D508D96A087FA005028C4C13D3C58B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

YCqHJwMNnT0p.bat

Path C:\Users\Admin\AppData\Local\Temp\YCqHJwMNnT0p.bat
Size 185B
SHA256 1d4de0c905ba8c445655615a29cdf60224d46e864de2106e81742d7282b9988d
MD5 7db6d3355421f9ad547ff4320cfe1e71
SHA1 334a1fca701734a7125e6c5434277c02871e2cf8
SHA512 3a95e311e1f917c34af115edd141c55759c4a0af81cc8625df513e73e91e5e68c9b96cfe8680a857e09b1acfd97eed1d03e354fafcccaf48b7bd2e2ae05c0765
TLSH
T1E0C0120145858A5E49045C1A19AAB6CCF0A509996A49BFA04A41C86C13E2CA8F5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

YLGmmE0mkhM2.bat

Path C:\Users\Admin\AppData\Local\Temp\YLGmmE0mkhM2.bat
Size 185B
SHA256 9b5801507a5fa532e10590119be5d4bd3fa420f394cfc3fd62b1414b04c5a907
MD5 a8d9528f633edc4704e3be85daca7b54
SHA1 d0aa04453652e7b8042b7efd70f10d1c96b3b059
SHA512 2d74392538dce05b6a2e0f007196eacd4774cdd050ca20a13263404c6fb9778f097b9b890e5d0bfaf6bea62edc9d1e52d3b5f61f2d1da51f894ee24c86c8ad1b
TLSH
T122C022014181CA1E45001C0B08A9668CF1A508982908BFA0450088AC13D3C5CB8CF3C2
MD5 SHA1 SHA512 TLSH

Submit Download

YTfKlMllKPke.bat

Path C:\Users\Admin\AppData\Local\Temp\YTfKlMllKPke.bat
Size 185B
SHA256 9129cc59e8fdc2c03eacb53ba02acedb97c1b57b86dc09023e44069189359bd9
MD5 40abc8cd255e0d4035e28adb092dab30
SHA1 ace3d8398710a8052dfb856cf929837994042b86
SHA512 0aee560df81954b3c0fd520825ca1faa34914a1b71dfd1518b5ff231fb61c73c05142ec935371b0e9f3b9a029060875c1da71aac534f449150024c1f0409712b
TLSH
T145C012014181CE5E46045C0B1AE967CCF09908992A497FA045118C5C13E3C59B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Z2jgmNknkmDO.bat

Path C:\Users\Admin\AppData\Local\Temp\Z2jgmNknkmDO.bat
Size 185B
SHA256 302807d40790c73c0988e7e48984cd357db68b1e49c668bb2ee57ca93c81af99
MD5 62374c1981122ffc88bad594d69fc3f8
SHA1 c96851d522d80cddeb15a9a9df4bbac3d3b2f4d3
SHA512 d524b467b93ca73dbd67fe2580e92f8e0f024f9a966cda3dba270d2931971ab850a813928edbb5de4c79c4fb4691b6f6934f77f3078ee85d0c10b0333ee153bd
TLSH
T1C1C0120141868A6E45045C0A5BE9778CF0EA09AD2E497FA04901C85C13D2C59B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Z7HSrhBSPSrD.bat

Path C:\Users\Admin\AppData\Local\Temp\Z7HSrhBSPSrD.bat
Size 185B
SHA256 98fa85f0bf49d8385fff57bb879676ce193cae111b8ce9745bb6499b118271e3
MD5 e8fafb91aa1acb22569ffa0966d9a557
SHA1 4f11d2de609130c7f75b34716cbf81ea4e2d39fb
SHA512 9cc3deec3a1aedfb45c3db04cb14c74d11ba4ba893c5e0502309f927efe61906cf3dad52e0f22b3569d570b55519efbfa030997187c4d1ac02ad800db441a39d
TLSH
T104C012414686CA5E49445C0B19E966CCF09508A929897FA045518C5C13D2C59B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

a9AGc1XPOeOO.bat

Path C:\Users\Admin\AppData\Local\Temp\a9AGc1XPOeOO.bat
Size 185B
SHA256 52b65e6f609e7bd7ffb0d696d5f9ab4e9699bbf6d3a83265347af2888179ea56
MD5 83761bede2ea9a213884819a8e707e65
SHA1 23b59484c2313c18bbce9fd17a2565341b0a1b00
SHA512 e387df64c1c4ed13fbb6e658cd15c3fe6eba3ff620e155cccd55dd90c30beefeb244ad1bfc4f1573cc5d8ff91e238eeb5f549e8502859f740d0068616b89fb83
TLSH
T19BC022004182CB1E05000C0B08A9628CF0E90C982E48BFA049108C4C13C2C5CB8CB782
MD5 SHA1 SHA512 TLSH

Submit Download

aWbwTkUw2OLO.bat

Path C:\Users\Admin\AppData\Local\Temp\aWbwTkUw2OLO.bat
Size 185B
SHA256 65e795f1c98fcadc25836aabb0e3b2fa13f18693272882d0ee085861fcfba6b6
MD5 5ecf875f20e3962d865d2652a19a76fb
SHA1 a007a445533b8fdf2ecee4970e04d511a2a8399a
SHA512 5717cf0799676353f67778c1aece5eb3f09093bd00c734236ef73f4cf93da350d92fb2aed4d48a5212663c373890d1a2506097269d921d32c3e7ef400febc83a
TLSH
T1D8C0120141818A5E69155C0A19A9668CF0D908A92A897FA44641885C23D7C98B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

ayFP7wrOJwzU.bat

Path C:\Users\Admin\AppData\Local\Temp\ayFP7wrOJwzU.bat
Size 185B
SHA256 aaf86b0cd2e002cfcd6814b69c2b7452c3241cdf7d72be8ae38f7be8f1e4e97a
MD5 403aa17a1a959095ed7af9ef3bd2f972
SHA1 487899359e0d22ea572a8ddf3da52611f969ead0
SHA512 cbc7b2752acc80e975c2bc41e3152e27d0d7f591c13047a2ecffd3f5cb6a43be0cef1582582191f96a03a379049d83a5d80044b126e168212922101e8e998924
TLSH
T1F4C0120142958A5E45145C1A19ED77CCF0D508A92949BFA446018C5C13D3C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

bhGnyiiTz9Gf.bat

Path C:\Users\Admin\AppData\Local\Temp\bhGnyiiTz9Gf.bat
Size 185B
SHA256 41c95522a40f54b462b4d0eb8c05930c9d4670e397ef30281a0b4a74f97e0ea3
MD5 2a7b70681ca0c7399405140f2f94a894
SHA1 f6455cfa84a134d96bc959e004b8e62a9b2f642a
SHA512 4bdf78f712b2637a0a038be068a5731fcf26abd7115cb13229e97129e9316ed70da46be0f1b09f7deabc47afa2edd78507bd912dc21c04dff1b6999c3cc711a7
TLSH
T17CC0120182818A5E56455C0A59A9768DF0990CA929497FA04551885C17D3C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

cKwPTqUU4GfI.bat

Path C:\Users\Admin\AppData\Local\Temp\cKwPTqUU4GfI.bat
Size 185B
SHA256 1609efc471ab0667b56b9a076055fa36b07cf3c40c1d32b776b91bd84efd41d9
MD5 0fcc93d98d37821aa1895b9200cc76a7
SHA1 1b0c38194d250a34d8a881d31d4ba5e0e09a7304
SHA512 e63d6f3a73c846e491d8e94f7f25b8c9149a1137511e8c24ed5485342daf53b782f49958e17901e86c3add49651450f62b69beb50f7c35b4df4c9d39f16508dd
TLSH
T16EC0120151858A5E49045C1A19A9A68DF199089D2A497FA04901885D13D6C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

dBeQLjSPF5mR.bat

Path C:\Users\Admin\AppData\Local\Temp\dBeQLjSPF5mR.bat
Size 185B
SHA256 7c67792dabea7eddb1bd53ca274d4a925a51883dc0af656a872c88e461fbd496
MD5 8b40932568be078fd57c9de5641e1a65
SHA1 81c485caa0f4fa1d539455d29813b73cd1445ab3
SHA512 15a39af21a1d769be7d42ca885b32157abd18701ddae2aca296edead2a1833dcf0e59e9c21ebdfe79dc16f49d5bae962b18879e68e62a9626f48587a10bdf3a7
TLSH
T1ECC0120141918A5E59045C0F59AEA78CF0960D9D29497FB44501CC5C17DACACB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

egaVTLlLh3l7.bat

Path C:\Users\Admin\AppData\Local\Temp\egaVTLlLh3l7.bat
Size 185B
SHA256 be161a04f18b20c44d220ee683d261c1a61d29461a4fab84d3d84ecb93138328
MD5 c1eaab5b088605dfda45fbe5a71749dd
SHA1 6c36273dbd674dddb1b5f5ef31376e3504377b5a
SHA512 009e89659eefbaeae6faad713cd1482c95f52a8f3937b782316df0b35508112d1277166ff32baaa340faaa4aa603958fbb55ddb450dabbc95ef5aab216174145
TLSH
T1EFC0120141938A5E56045C1A59E9778CF095089929497FA04611C85E53D2C68B5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

ervDVkCWeirw.bat

Path C:\Users\Admin\AppData\Local\Temp\ervDVkCWeirw.bat
Size 185B
SHA256 103441bc9e0aa68d7e7bb9df38a0984f4fca0b623d237bf67b4c418705f5f3af
MD5 78b6314292b88f6118f6e9538fc1f395
SHA1 0b9ec42de7b0191cd46810f9d6860d9f80d76f7a
SHA512 a3417f5ed6d2ed919711b499cb184b41994bad49dd4d54cd22871a340a5cf2bb106a41c1ff554129e4a7f79ac33b0f59776f240e72c7aa0e821db5b75000512d
TLSH
T1A3C0120155818B5E55045C0A19A9668DF195099D29497FA14A01885D13D2C6CB5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

etLvN0nVz3St.bat

Path C:\Users\Admin\AppData\Local\Temp\etLvN0nVz3St.bat
Size 185B
SHA256 350dfec20c0e6ab1ca69b7bfc2d2cdcf3fc691aadeeb23c968d053c3ef3f178d
MD5 43c1478e141102693709e20ef9279317
SHA1 819dd966cab615ceab41022dc4e0c5ee01bd92e4
SHA512 c03cc8ceedcc42d76919bb0ff88fc7d551a30c57a08d9636b1e5e4380d53bde51c4d28d653f0c2c121da5911140e9d1a35bf12692dae8cf7c4ae41bb778cbf35
TLSH
T1F0C0221041828A2E15000C0B18AD728DF09908A96A0A7FA00600CC4D13C2C68B4CF3C2
MD5 SHA1 SHA512 TLSH

Submit Download

exE1KQEJ0PBM.bat

Path C:\Users\Admin\AppData\Local\Temp\exE1KQEJ0PBM.bat
Size 185B
SHA256 f1f2271945dafb95be6b32d0e63e70450d528a9b5ffb282158de6eeb95284a95
MD5 273602fdadba65350864ba98f468f9af
SHA1 660bbc59a9d6032319c7b5ab4b87223fe1abbfec
SHA512 48aa2708e653c351439f1f259abbd89e5cc54fe925133867fbe3c1954361b379c88e0a2036475f70f981baa71617499ff91c38aa17440d403cf927f93505ce6b
TLSH
T1F7C0120155818A5E55045C0B19E9768CF1A908A92E497FA14541889C23D2C69B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

hRVxK6R0iVOW.bat

Path C:\Users\Admin\AppData\Local\Temp\hRVxK6R0iVOW.bat
Size 185B
SHA256 82883889c0450215703c3a6961fea5e81bb1cd364b7e4ca7372b080ca4adca22
MD5 bc5bc11164a6f1cc56d5940261c3a2bc
SHA1 942be263f87123f3e7feb8374fbcff6d552c9d6e
SHA512 9be8fd718a04b374669f9d8e06afd07ad66672c660abc7d0c65e675f2a706114125d2434d36750c40b3d96e73325cdb70b517c4b25a4843697615163cd5d2b60
TLSH
T19DC0120141818A5E56045C0A1DA9A68CF09608996D497FA049258C5D23D3C58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

iOn9eNUnmlq6.bat

Path C:\Users\Admin\AppData\Local\Temp\iOn9eNUnmlq6.bat
Size 185B
SHA256 8efb5c54d24beedfced00bf18fc13cfc73255bc58e86edc9b9b27854d07cb21e
MD5 6833d9f9c6d07f2f043e58de83f09901
SHA1 c4be4a7939aca65fae0ff605e75a33157be1d2cc
SHA512 94a3340ecd98aab92f4e374786d70e5edace92737a7bbcd11657372a6b7c2b97dcdd262ac7a81e27a4d0736046aa196e74c348a42f61b6a5440981aa9f16d31c
TLSH
T148C012014285CA6E45045C1B59A9678CF0A508A92D497FA44501C85D13E3CA8F5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

lKLxtDH7TKzO.bat

Path C:\Users\Admin\AppData\Local\Temp\lKLxtDH7TKzO.bat
Size 185B
SHA256 e28518b44ea15b162640787b93bc23605ea25fab9f6c68e4485554098b934aae
MD5 8b745dc2d37c0669f56f649c81702da0
SHA1 8c5090daeeb235d7333911432005c59e585e57c7
SHA512 24a58adf33f542f5f24f31eed60ac145ae7c7b456c409f7a96eac5061cce29d83b852f0f67abce5203e54c2260c72b17c15b055d9d05027c22ac1491456c80d3
TLSH
T18EC0120145818A5F46445C0B19A9A7CCF0D9089929497FA04551885C13D2C69B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

lXUp4lFqAlpO.bat

Path C:\Users\Admin\AppData\Local\Temp\lXUp4lFqAlpO.bat
Size 185B
SHA256 db833346004e59f45cf351d58a7126fb0b75c1187fa4533f0cf085913fcd691a
MD5 52120d08a42109e64c0ddf4144abd762
SHA1 e669107af9c62b28881e0f5e73638de2d0050727
SHA512 0a58dd7ac94cab355737233d35f919a13af07c252cbde5a41bd115dc84626b74a9ddc47297e67261dd8895fdb71295a397c90678a3154c573f64c854e26c4924
TLSH
T178C012014581CA6E45045C1A59A966CDF0D9089969497FA04501885C23D3C59B5DB783
MD5 SHA1 SHA512 TLSH

Submit Download

mouIx0cQaG0m.bat

Path C:\Users\Admin\AppData\Local\Temp\mouIx0cQaG0m.bat
Size 185B
SHA256 a7eaf3a1a3f3deda3c26e3361689f6f61f5c56a03ebb1a7392946c325aa57021
MD5 3b51898b4f177979a6921fe72fd95ed2
SHA1 f60860184d29d2a9e29709f45d838e55718f60a0
SHA512 a8e42a2194a0320176ff9355d77eab0a73a09940f0abafda94be4eaad3c4a449a56a531c53e102d97ee6e1ba036461e925298413f72030746a479f39f312fd12
TLSH
T108C0120141858A6F4A049C0B19E9A78CF195099D6A497FE04541889C13D3C59B9DF792
MD5 SHA1 SHA512 TLSH

Submit Download

tR0azuA4f8Rt.bat

Path C:\Users\Admin\AppData\Local\Temp\tR0azuA4f8Rt.bat
Size 185B
SHA256 a4977bd24501de4952fc639736561ea35600254ac7580145d174d6ca16175c8c
MD5 bc3d1e165e1b2916875e3cfc0eb477c1
SHA1 87b8de5b3f4045a3bf6ef62fd3b427f383e62eae
SHA512 82110cab81ff131f75e9b85a1bc3199df94d93d0a50eae56b35a9f583037e2319f216b0f8350f3e5cebf65211d307e7945bdca214f3b606cdf1f3c96b6bd0899
TLSH
T1C4C012014282CA5E45445C0B19A9E6CCF0E508A96A4D7FA04501CC5C53D6D59B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

uhJILjvsks2E.bat

Path C:\Users\Admin\AppData\Local\Temp\uhJILjvsks2E.bat
Size 185B
SHA256 331c9220a05c7b0f25907bcfb65edc8fa3aeb3e5f8ccaf45dbcf9808c0fc5824
MD5 f375a6a3e40c69da4a665c2010aefffd
SHA1 4d4f6520bbabc938f682e70a06f154822a0cf672
SHA512 9024ba7e202f3c081b5975c0c6956eaca19153302f9d8cfc87e405ee6c3d127366dcae25fcf2bdce137e013edbbc74b9be23153fdb9416b759a4d8bf830e9ac4
TLSH
T1FCC0120141D1CA5E59145C0A19A9A68CF09608A92A49BFB049428C5C13D3C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

uhk4QwZ9ABGL.bat

Path C:\Users\Admin\AppData\Local\Temp\uhk4QwZ9ABGL.bat
Size 185B
SHA256 29e5fc48a77a29430e58f0f88cf98e69ab11443f5c2148dd4746bda73593ec2a
MD5 e30ae9c000c8987fea25459975a1a949
SHA1 9fd10c355ee213f7104f2a51da00d88198924aad
SHA512 1a053e664037eb0249eaa2a43557583a7875ea189d47f2347359f39063ff32c5b98c518309848e83612bd9eedd8d4d6c8f7e3da97f47d51bb6f0394b0e832bcc
TLSH
T168C0120182C18A5E46045C0A19A9668DF19909A929497FE046018C5C53D6C59B9DB792
MD5 SHA1 SHA512 TLSH

Submit Download

voCurpdUnwT7.bat

Path C:\Users\Admin\AppData\Local\Temp\voCurpdUnwT7.bat
Size 185B
SHA256 edb3ac2c3839d90eda94a99c9fc6c1c61c3b4c3ef838af369d0367ed9f9791f6
MD5 522e63caad8258fc082e71e1e2bf0d9c
SHA1 ff0ac1f1bc2375f33f12f68fb6d2b48ac63566b0
SHA512 2ec27a85690597ac562b9163e1b9488774281354bec176707e143c1b0613573b75cec6c7617e5607bdca1da7675c1d57769b246bb410268d470e7310c5e5ddcd
TLSH
T1A3C0120145818A5F46045C0A59A9A68CF0B908992E4D7FA54501C85C13D6C6DB9CB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

y0Ma0LEnmybP.bat

Path C:\Users\Admin\AppData\Local\Temp\y0Ma0LEnmybP.bat
Size 185B
SHA256 877540ea7c07d1a97932387387e7b5f144f2bafa42ac691d9248091a195f7d55
MD5 a6790f14dda2e8157f02371c02a10043
SHA1 6bbf9b6b5cf7ef33508b58b7ed44fec3a5b4fa08
SHA512 7f283516c8c42f0fb57f47ae63e6e6f80ceda564a239155e3829c7e18529bc0ca24747caf5d4aba4916e969e3ab95d1bf18fb3820b759cb69adf6fa95b4cce8d
TLSH
T13DC0120241818A5E89045C0A59A9678CF0A50D9D6D497FA04901885D23D2C68B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

yEGys5HrTfWl.bat

Path C:\Users\Admin\AppData\Local\Temp\yEGys5HrTfWl.bat
Size 185B
SHA256 39a0aba0d3dae0b4cee6e11a02e5591bf41e50a04028b0fc97001cdbb8e301bf
MD5 9f541191a15918db516c496f2e7c688c
SHA1 8fdedaf9d21c537ed3292faaead33bd651b2b224
SHA512 f7dd9912ed355b17f1006c3b035513cbdb3248b740d760a5ef233a03cfa08578fa055ff6c68a3fcedd8802f852bc1de19ce2e83c6699ed0315a8229faf4f614b
TLSH
T1A7C0120141818A5E85145C0B19AAA68CF0990DA9294DBFA44941885C17D2C68B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

yIOVQQRcLQxN.bat

Path C:\Users\Admin\AppData\Local\Temp\yIOVQQRcLQxN.bat
Size 185B
SHA256 9ab39bc6b8f3f0ee0a451492547456966c27fb315ff9ead32d67a0feb495b107
MD5 701d2c31d891e7749402a6b3977f442a
SHA1 9d6306c39d2b8cd3b9d17fa9e3d72968d15f2577
SHA512 9418b84b9e6b2e4a5ba2ce878b7d4bfa84c8a094ef01f5003e10d1f340e20e49e09d221c2a49335c98ca2162768020107c4d65065bf567a1ea3f984a6a866f3b
TLSH
T1F2C0120192918A6E4504AC0A19EA668CF0950C99A9497FA14541885C13D3C98B9DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

yYpry1Lc1z2x.bat

Path C:\Users\Admin\AppData\Local\Temp\yYpry1Lc1z2x.bat
Size 185B
SHA256 dcbedc553d6300674f05e5fca5929dc0ecf102923e89baaba4200df1af42e926
MD5 f51e0b308a84496348e53eea0fcfcacd
SHA1 96ac6f4b1d340d8cd48cf1a47d93436c042a4de5
SHA512 28715a987b6d677f2636734c1a4481ecbe97e4c4bae6b4218accbba145ea88c5276d073fdc80984551b3eb596c0f37fa7fc211284e32474ff62d313d15335c7f
TLSH
T16FC0120196818A5E45049C0A19A9A68CF09508992949BFA049518C9C53D2C5CB5DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

ygeTx8v2Vmee.bat

Path C:\Users\Admin\AppData\Local\Temp\ygeTx8v2Vmee.bat
Size 185B
SHA256 d7dec4de7c12afc8b27ad15c091bef56589b05c6acc1d1aa7f1d2555df46001f
MD5 f88cc08ab258463655cf308b90144af1
SHA1 1e9ef5e792690eac7aba078f431b0bdff861e8f7
SHA512 a37ac94f104399ce38c3262fefbdf046c099f2b9ee17d2ba5fc8d528b34b4c2c0be999d0286f14069574dfa774e4740d61bc949eb9beff9766a2ce22ca6593b8
TLSH
T1E6C0120141928A5E45049C1B19A9A6CCF19A099D2D497FB14911885C23D2C59B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

ziaE9HJDA66E.bat

Path C:\Users\Admin\AppData\Local\Temp\ziaE9HJDA66E.bat
Size 185B
SHA256 fb7c10d15062ff608691630ee65d815741c9e6535322cd6ae326bcbe43012087
MD5 bf0930a335b729b2c7abaf68caa6678f
SHA1 e388e056846de34b764d311efd2f06a29ff43d75
SHA512 89e485451a1dbfb9129007476fc527d6cb2579086e15498b59879e46fb3daadb313c14d50af2e4dcb79f627ee818ff2fd82ad5230fc75535e3581dfc98a0400a
TLSH
T1E5C012018282CA5E5A046C4A19A9668CF0D508992949BFB489058C5C23D2C58B9DB786
MD5 SHA1 SHA512 TLSH

Submit Download

memory/740-118-0x0000000000E70000-0x0000000000E82000-memory.dmp

Download

memory/768-233-0x0000000002840000-0x0000000002852000-memory.dmp

Download

memory/772-43-0x00000000013F0000-0x0000000001402000-memory.dmp

Download

memory/1080-93-0x00000000031D0000-0x00000000031E2000-memory.dmp

Download

memory/1188-143-0x0000000002560000-0x0000000002572000-memory.dmp

Download

memory/1292-273-0x0000000002B40000-0x0000000002B52000-memory.dmp

Download

memory/1352-53-0x0000000001960000-0x0000000001972000-memory.dmp

Download

memory/1356-123-0x0000000001620000-0x0000000001632000-memory.dmp

Download

memory/1412-288-0x0000000003180000-0x0000000003192000-memory.dmp

Download

memory/1624-303-0x0000000000D70000-0x0000000000D82000-memory.dmp

Download

memory/1724-258-0x00000000027E0000-0x00000000027F2000-memory.dmp

Download

memory/1768-63-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

Download

memory/1928-73-0x0000000001260000-0x0000000001272000-memory.dmp

Download

memory/1944-68-0x0000000000F40000-0x0000000000F52000-memory.dmp

Download

memory/1984-148-0x0000000000F10000-0x0000000000F22000-memory.dmp

Download

memory/2188-58-0x0000000001990000-0x00000000019A2000-memory.dmp

Download

memory/2192-138-0x0000000000D50000-0x0000000000D62000-memory.dmp

Download

memory/2196-33-0x0000000000F50000-0x0000000000F62000-memory.dmp

Download

memory/2200-298-0x0000000002880000-0x0000000002892000-memory.dmp

Download

memory/2208-223-0x0000000002420000-0x0000000002432000-memory.dmp

Download

memory/2308-213-0x0000000002F10000-0x0000000002F22000-memory.dmp

Download

memory/2516-308-0x0000000002D60000-0x0000000002D72000-memory.dmp

Download

memory/2592-203-0x00000000030D0000-0x00000000030E2000-memory.dmp

Download

memory/2648-198-0x0000000002E60000-0x0000000002E72000-memory.dmp

Download

memory/2704-248-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

Download

memory/2888-83-0x0000000001290000-0x00000000012A2000-memory.dmp

Download

memory/2908-163-0x0000000002E20000-0x0000000002E32000-memory.dmp

Download

memory/3252-188-0x00000000011B0000-0x00000000011C2000-memory.dmp

Download

memory/3668-318-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/3756-28-0x0000000000C40000-0x0000000000C52000-memory.dmp

Download

memory/3856-228-0x00000000026F0000-0x0000000002702000-memory.dmp

Download

memory/3972-108-0x0000000001530000-0x0000000001542000-memory.dmp

Download

memory/3976-88-0x00000000027B0000-0x00000000027C2000-memory.dmp

Download

memory/3980-263-0x00000000031F0000-0x0000000003202000-memory.dmp

Download

memory/4128-0-0x0000000000480000-0x00000000007AC000-memory.dmp

Download

memory/4128-1-0x00000000029E0000-0x00000000029F0000-memory.dmp

Download

memory/4128-6-0x0000000000EC0000-0x0000000000ED2000-memory.dmp

Download

memory/4296-173-0x0000000000D70000-0x0000000000D82000-memory.dmp

Download

memory/4452-238-0x0000000002B40000-0x0000000002B52000-memory.dmp

Download

memory/4504-18-0x0000000001720000-0x0000000001732000-memory.dmp

Download

memory/4552-113-0x00000000010F0000-0x0000000001102000-memory.dmp

Download

memory/4748-208-0x0000000000FF0000-0x0000000001002000-memory.dmp

Download

memory/4768-158-0x0000000001910000-0x0000000001922000-memory.dmp

Download

memory/4864-283-0x0000000001060000-0x0000000001072000-memory.dmp

Download

memory/4960-153-0x0000000001A50000-0x0000000001A62000-memory.dmp

Download

memory/4980-253-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Download

memory/5032-293-0x0000000001970000-0x0000000001982000-memory.dmp

Download

memory/5100-9-0x000000001B660000-0x000000001B670000-memory.dmp

Download

memory/5100-13-0x0000000001180000-0x0000000001192000-memory.dmp

Download

memory/5112-103-0x00000000025C0000-0x00000000025D2000-memory.dmp

Download

memory/5144-193-0x00000000028A0000-0x00000000028B2000-memory.dmp

Download

memory/5148-133-0x00000000010D0000-0x00000000010E2000-memory.dmp

Download

memory/5172-128-0x0000000001A00000-0x0000000001A12000-memory.dmp

Download

memory/5304-183-0x0000000001260000-0x0000000001272000-memory.dmp

Download

memory/5320-98-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Download

memory/5392-323-0x0000000001260000-0x0000000001272000-memory.dmp

Download

memory/5516-313-0x0000000000EB0000-0x0000000000EC2000-memory.dmp

Download

memory/5532-168-0x0000000001AA0000-0x0000000001AB2000-memory.dmp

Download

memory/5592-268-0x0000000002A80000-0x0000000002A92000-memory.dmp

Download

memory/5616-278-0x00000000012D0000-0x00000000012E2000-memory.dmp

Download

memory/5732-48-0x0000000001440000-0x0000000001452000-memory.dmp

Download

memory/5780-38-0x00000000015D0000-0x00000000015E2000-memory.dmp

Download

memory/5812-178-0x0000000002F20000-0x0000000002F32000-memory.dmp

Download

memory/5868-78-0x0000000002AB0000-0x0000000002AC2000-memory.dmp

Download

memory/5876-218-0x0000000002E50000-0x0000000002E62000-memory.dmp

Download

memory/5912-23-0x0000000000D90000-0x0000000000DA2000-memory.dmp

Download

memory/5920-243-0x0000000001B60000-0x0000000001B72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads